MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7e0dcd4f0b7db9575a8014ca2baabf040026de61410f220193d2b5406bae50f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b7e0dcd4f0b7db9575a8014ca2baabf040026de61410f220193d2b5406bae50f
SHA3-384 hash:	716ebd4585947f4bbb251da3f5f42c172b4e93ad6fdf7b9f5d6ebc0f73a963764543a6bf17d2295e44d6a24c64007573
SHA1 hash:	a8ea94f134b66a279c85bf23f0abf6d0acdb3308
MD5 hash:	e697b07378aef1cfa2e1da39caa9295f
humanhash:	green-stairway-carbon-august
File name:	nDocumentos_Datos_Bancarios_17062026_xml.bz2
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	17'960 bytes
First seen:	2026-06-17 21:01:13 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	384:X7O/0sX2L4MEM3CPDxbeaCfyFv4NeRtTJ5Yk4lwkr:rq0sXBDxeaCmE4TJ5YPlDr
TLSH	T1D482D1B19D1938EA7E0E9E3DDDFEB91C8962DF64A226156EE5CB0145C82810431ECF2C
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	FXOLabs
Tags:	AgentTesla rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

79

Origin country :

US

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Documentos_Datos_Bancarios_17062026.xml.wsf
File size:	44'437 bytes
SHA256 hash:	488a04dd1b79adde9860f84cdc3f0c3764d8c0e8b53c1506a73f2810796d0f56
MD5 hash:	0f47c3cbf5739986115efe313cba7ce8
MIME type:	text/xml
Signature	AgentTesla

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/e5039736-d0eb-48a1-94b5-5e5d91a8fdf2/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Wsf_Rar_1.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Foxhole.Rar_xml.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a330b2454a045c3408a087d

Tags:

shell spawn lien hype

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

aspnet_compiler base64 encrypted evasive evasive lolbin masquerade reconnaissance

Link:

https://www.filescan.io/uploads/6a330b599799578a6c3e178a/reports/26582ae1-ab03-4c6c-bf45-8418d4a57392/overview

Hybrid Analysis HEUR/Suspar.Generic

Verdict:

Suspicious

Labled as:

HEUR/Suspar.Generic

Link:

https://www.hybrid-analysis.com/sample/b7e0dcd4f0b7db9575a8014ca2baabf040026de61410f220193d2b5406bae50f

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-17T16:30:00Z UTC

Last seen:

2026-06-19T17:20:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/b7e0dcd4f0b7db9575a8014ca2baabf040026de61410f220193d2b5406bae50f/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b7e0dcd4f0b7db9575a8014ca2baabf040026de61410f220193d2b5406bae50f/

Neiki Family.AGENTTESLA

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/b7e0dcd4f0b7db9575a8014ca2baabf040026de61410f220193d2b5406bae50f

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-17 21:02:14 UTC

File Type:

Binary (Archive)

Extracted files:

2

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w7qnzvhqw7nzk5niafgkfovl6baae3pgcqipeiazhuvvibv24uhq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b7e0dcd4f0b7db9575a8014ca2baabf040026de61410f220193d2b5406bae50f