MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e189ccd0c160788e36444b5e0883042b2e3514cbaf71d4d81a02f95af5591fb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e189ccd0c160788e36444b5e0883042b2e3514cbaf71d4d81a02f95af5591fb2
SHA3-384 hash:	f0e2373ed94252af086dc8f5a759d5f066195e9e7a5646dcccbc6e648f80de203a887a351b7145354fcc6d2fa06c85d5
SHA1 hash:	9e5ca35403580c271a52bece0129bb2a5f33d48b
MD5 hash:	ce3d93a6bd9b3cb69ddffc6aee23816d
humanhash:	cat-seventeen-black-robert
File name:	Richiesta d'ordine PNCG-0027392026.BZ2
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	12'005 bytes
First seen:	2026-07-21 09:40:43 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	96:ZmAZCoZ2SI6nslcLfU5EYanHXzgn5Tdbcj3ME5tEHrXK:bZdZE6E4u2Xzevcjntd
TLSH	T14B42C5EAB0E578FFFAD851BB441DD6F371E42C22EAA42508B43355F192E08A48067FD1
Magika	zip
Reporter	JAMESWT_WT
Tags:	AgentTesla ikzwhpl Spam-ITA zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

91

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Richiesta d'ordine PNCG-0027392026.hta
File size:	2'257'581 bytes
SHA256 hash:	28f592105342cd4f8719a41a355e859428c5e0844a4843ef71d8307c068034d0
MD5 hash:	768d36e15c427624087a955317909c2f
MIME type:	text/plain
Signature	AgentTesla

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/c665738c-a558-4060-8415-3e1b4e89ca73/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Hta_Zip_2.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Foxhole.Hta_Zip_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.HTML.HideMe-22.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5f3ea885479d70bfb7937a

Tags:

n/a

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/e189ccd0c160788e36444b5e0883042b2e3514cbaf71d4d81a02f95af5591fb2/results/dashboard

Payload URLs

URL

File name

https://pub-e17adc2984a64a2f8f2a3f402fd92e53.r2.dev/ikzwhpl.png

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6a5f3ea05729109212e17624/reports/c755acbe-3940-45d0-904c-1345a0761262/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e189ccd0c160788e36444b5e0883042b2e3514cbaf71d4d81a02f95af5591fb2

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-07-21T04:58:00Z UTC

Last seen:

2026-07-22T21:55:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e189ccd0c160788e36444b5e0883042b2e3514cbaf71d4d81a02f95af5591fb2/results?tab=lookup

Nucleon Malprob Susipicious

Score:

54%

Verdict:

Susipicious

File Type:

ARCHIVE

Link:

https://malprob.io/report/e189ccd0c160788e36444b5e0883042b2e3514cbaf71d4d81a02f95af5591fb2

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Zip Archive

Link:

https://app.malva.re/file/ce3d93a6bd9b3cb69ddffc6aee23816d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e189ccd0c160788e36444b5e0883042b2e3514cbaf71d4d81a02f95af5591fb2/

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-21 14:31:11 UTC

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4ge4zugbmb4i4nsejnparayefmxdkfglv5y5jwa2al4vv5kzd6za._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260721-mmfn2sey3s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Badlisted process makes network request

Family: AgentTesla

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e189ccd0c160788e36444b5e0883042b2e3514cbaf71d4d81a02f95af5591fb2