MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfc340faba4a6685ee6fc715e8ae6d43add6651934a0f225c013303fc3398ea3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bfc340faba4a6685ee6fc715e8ae6d43add6651934a0f225c013303fc3398ea3
SHA3-384 hash:	814f439b8c72149a7a0049ea89034ad371de2faebcbae69da506569220422b053a96d27c454b7ced027ce67041804231
SHA1 hash:	5f2ce3a2a6e411dde1efd0a2afd007c9c02e0e1d
MD5 hash:	10ebeb295f620fda263cd8478b7f19d1
humanhash:	stream-eight-fillet-asparagus
File name:	Purchase Order EDG6453.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	3'823'815 bytes
First seen:	2026-05-26 13:04:41 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:cCAVJyOvxi9mhOgDfE7zTRQ9vkXbXp60rqoWVFKWAUU9gub83EX65e3xoE4gpl2b:izvxi9mhOcfE7zTRQ9vkXbXp60rqoWVL
Threatray	191 similar samples on MalwareBazaar
TLSH	T1B7064BC254E392637721DBEB5A39FE30A40E9C0319958B347A4EE63B351DD47712A3A3
Magika	javascript
Reporter	James_inthe_box
Tags:	AgentTesla exe js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

160

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Rogue.0hr.20260525-0532.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.32567.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a159a9f5b1db29f5a480ad2

Tags:

spawn lien blic hype

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive masquerade obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a159a9712da0d249c5871a8/reports/5bb15b4b-def0-4a66-a1ad-fe07f8931d0f/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/bfc340faba4a6685ee6fc715e8ae6d43add6651934a0f225c013303fc3398ea3

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-05-24T22:17:00Z UTC

Last seen:

2026-05-28T09:16:00Z UTC

Hits:

~1000

Detections:

Trojan-PSW.MSIL.Agensla.sb HEUR:Trojan.Script.Generic Trojan.Win32.Shellcode.sb Trojan-Downloader.JS.Cryptoload.sb HEUR:Trojan-Dropper.Script.Generic HEUR:Trojan-Downloader.Script.Generic Trojan.Win32.Agent.sb Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Disco.sb

Link:

https://opentip.kaspersky.com/bfc340faba4a6685ee6fc715e8ae6d43add6651934a0f225c013303fc3398ea3/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bfc340faba4a6685ee6fc715e8ae6d43add6651934a0f225c013303fc3398ea3/

Neiki Family.AGENTTESLA

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/bfc340faba4a6685ee6fc715e8ae6d43add6651934a0f225c013303fc3398ea3

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-25 03:45:38 UTC

File Type:

Binary

AV detection:

11 of 38 (28.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=x7bub6v2jjtil3tpy4k6rltniow5mzizgsqpejoacmyd7qzzr2rq._file

Threatray donutloader agenttesla

Verdict:

malicious

Label(s):

donutloader

Alert

Create hunting rule

agenttesla

Alert

Create hunting rule

Similar samples:

1a5f6870dce757bae62ceaf98999acaa48ea784b2b7c14abb213cbc3e550a4c6

AgentTesla

2d6c2f5c0122193732dbb6749994c5e6286e456545e012d47d4ec7f4d5abe7ce

AgentTesla

34e1551055a3db36eea0438f165ab00b60c47e503e8af3f8ecc9aca66c4ffb13

AgentTesla

4f0f7232dc36c768cd481ee494acc71c1de3581e46776d2ab6707ef8b225a3e6

AgentTesla

7405451ae98a7a3268b37e7cf8dca5ff70c3bb2f48dfc4e6d023a3079b4df7dd

AgentTesla

8fe592d0af4913f9cc100a369c358bd7463dc94d2d5a1d7e9bf824be2e26b268

AgentTesla

aa0f0b7c3e070ff4c61eb188fb1121a3c7cd553dfe5df8d2f089498e7b08abd7

AgentTesla

b22c56c0c809bda92b3a5d1eb81c035235263e3bd2d126841345bcf1ee43b458

AgentTesla

b853b61b0ac822b0544f86220bf521bb640c2de25d6de7fe1a92bceecebc3c09

AgentTesla

+ 181 additional samples on MalwareBazaar

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader collection execution keylogger loader spyware stealer trojan

Link:

https://tria.ge/reports/260526-qbqxescx5y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VMRay AgentTesla

Malware family:

AgentTesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bfc340faba4a/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/bfc340faba4a6685ee6fc715e8ae6d43add6651934a0f225c013303fc3398ea3