MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9496b034ca77f4adbdb02044acac18e6f074ff75c9089c55e33b330c4e5f87c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b9496b034ca77f4adbdb02044acac18e6f074ff75c9089c55e33b330c4e5f87c
SHA3-384 hash:	5d687b8fa302d5015fc8922b9aa5850551a744e054856480681a9fe9cec9818114ea375b6b6512c5b43829f06d107d9d
SHA1 hash:	d176953770876df715ddaf312093d7a1490db492
MD5 hash:	1e61ed24b5ab58820bf7621bb51c2299
humanhash:	fish-sixteen-friend-football
File name:	justificanteTransferencia.tar
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	1'202'336 bytes
First seen:	2026-07-13 17:55:55 UTC
Last seen:	Never
File type:	tar
MIME type:	application/x-rar
ssdeep	24576:AyVlFOYJeBMKMfO9jv4ZpqvQI0sQrSNNUYuujTpCFiR+au6iDMBc:NnFBzW9r4D9iUYzRJiqc
TLSH	T1E945334E38BF5519F9CB5BBC939A810FA66B05AE4254A660FC38813B716D5B3423FCD0
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	JAMESWT_WT
Tags:	AgentTesla ftp-telewatte-pe-com Spam-ITA tar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

90

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	justificanteTransferencia.JS
File size:	3'469'494 bytes
SHA256 hash:	421798ea7bd98b7027ae3965fba2e50464a5c8da3d0b5f77e7bfded1e3dc01f9
MD5 hash:	cd14d2460ed0b968499bd8f7a1133b54
MIME type:	text/plain
Signature	AgentTesla

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/364aca5d-1f42-48d6-8d53-e7c4569a7832/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5526da737be7d52c91b1a1

Tags:

virus lien sage blic

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug downloader dropper evasive obfuscated obfuscated packed repaired xloader

Link:

https://www.filescan.io/uploads/6a5526d455634267aeec5697/reports/3b643be6-f988-489b-a253-84dc34970748/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/b9496b034ca77f4adbdb02044acac18e6f074ff75c9089c55e33b330c4e5f87c

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-07-13T11:02:00Z UTC

Last seen:

2026-07-13T13:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b9496b034ca77f4adbdb02044acac18e6f074ff75c9089c55e33b330c4e5f87c/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/1e61ed24b5ab58820bf7621bb51c2299

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b9496b034ca77f4adbdb02044acac18e6f074ff75c9089c55e33b330c4e5f87c/

ReversingLabs TitaniumCloud Win32.Trojan.Ravartar

Threat name:

Win32.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-13 13:18:21 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

9 of 37 (24.32%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xfewwa2mu57uvw63aicevswbrzxqot7xlsiitrk6goztbrhf7b6a._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260713-z7navagy7p/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b9496b034ca77f4adbdb02044acac18e6f074ff75c9089c55e33b330c4e5f87c