MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e67cfee8d7619ab318c896c9e7e1374743a3277f0165a49f5ed7cf76685dcd9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	e67cfee8d7619ab318c896c9e7e1374743a3277f0165a49f5ed7cf76685dcd9b
SHA3-384 hash:	a67cf95f4612eb3641f51d9dee695bc4a3225d8612d7b757804f62d2970045577a5c0de6a2b60b4d5076d4f53f84bf56
SHA1 hash:	806cececd7d8d34dba6c0726eb2ad3dcd9945614
MD5 hash:	759fda135b42fee60a69d175fdb1a40c
humanhash:	beer-wolfram-uniform-georgia
File name:	IMG-20251128-2025000371.js
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	843'050 bytes
First seen:	2025-11-28 11:36:12 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	24576:oTKuvLo9sZLRohZQcVGd5JCONlxUe+lmFGR8jCCRVoA:oTKuvLo9sZLRohZQcVGd5JCONlxUe+le
TLSH	T197055B60DD68022E4F531BDDFCA54B65CABD850A472A84F1FAD90B0D71065ECE3BE62C
Magika	javascript
Reporter	NDA0E
Tags:	AgentTesla geo GRC GuLoader js

Intelligence

File Origin

# of uploads :

# of downloads :

133

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.JS.Obfus-829.UNOFFICIAL

Sanesecurity.Malware.27199.JsHeur.UNOFFICIAL

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=692989326cb1dcd57781f18f

Tags:

infosteal hype

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/69298931d0d5e7288b4f42d1/reports/1bb8c522-fd77-4b8c-941f-881fd959bf5b/overview

Verdict:

Suspicious

Labled as:

TrojanDownloader/JS.Netloader

Link:

https://www.hybrid-analysis.com/sample/e67cfee8d7619ab318c896c9e7e1374743a3277f0165a49f5ed7cf76685dcd9b

Verdict:

Malicious

File Type:

text

First seen:

2025-11-28T04:34:00Z UTC

Last seen:

2025-11-30T09:28:00Z UTC

Hits:

~10000

Detections:

HEUR:Trojan-Downloader.Script.Generic HEUR:Trojan.Script.Generic HEUR:Trojan.Script.Agent.gen

Link:

https://opentip.kaspersky.com/e67cfee8d7619ab318c896c9e7e1374743a3277f0165a49f5ed7cf76685dcd9b/results?tab=lookup

Score:

86%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e67cfee8d7619ab318c896c9e7e1374743a3277f0165a49f5ed7cf76685dcd9b

Verdict:

inconclusive

YARA:

2 match(es)

Link:

https://app.malva.re/file/759fda135b42fee60a69d175fdb1a40c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e67cfee8d7619ab318c896c9e7e1374743a3277f0165a49f5ed7cf76685dcd9b/

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/e67cfee8d7619ab318c896c9e7e1374743a3277f0165a49f5ed7cf76685dcd9b

Threat name:

Script-JS.Downloader.AgentTesla

Status:

Malicious

First seen:

2025-11-28 07:34:00 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 24 (29.17%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4z6p52gxmgnlgggis3e6pyjxi5b2gj37afs2jh2627hxm2c5zwnq._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla adware discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/251128-nqplsscr3w/

Behaviour

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates connected drives

Looks up external IP address via web service

Checks computer location settings

Badlisted process makes network request

AgentTesla

Agenttesla family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.81

Link:

https://yomi.yoroi.company/submissions/e67cfee8d7619ab318c896c9e7e1374743a3277f0165a49f5ed7cf76685dcd9b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)