MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e84c25dc709602462feecd1e686b5556a89de10f9cd3ea6af6a69dcdbcf7f591. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e84c25dc709602462feecd1e686b5556a89de10f9cd3ea6af6a69dcdbcf7f591
SHA3-384 hash:	b2a6ebbe98c3abe564521daeca6887b343e1559f56abb2a6772fa4f9aa396ba0f9ddc5107e958f887fe3ab03718beba2
SHA1 hash:	0becd2d59dfa49ee0297fc9abc3a36ae553c64cd
MD5 hash:	969cc274cfd88317abbdc21d4251bbca
humanhash:	zulu-batman-berlin-dakota
File name:	LY26045008 INV.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	3'451'286 bytes
First seen:	2026-07-15 07:25:57 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:57rU2A464QPZGcf5Jx1bHtMxSrIPyajXGoMHyLN9I+2Yaco5I:BQRGcfxlpIPy7oMSLfIPY9oa
Threatray	160 similar samples on MalwareBazaar
TLSH	T18EF52910C32CA475952ED73ED03AAF68054D600321EEEF2D36BE1624BB56E47974E9E3
Magika	javascript
Reporter	abuse_ch
Tags:	AgentTesla js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

171

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5736b856bd89099b55509a

Tags:

virus lien sage blic

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a5736798beb74f3a7b5ed95/reports/424c6b6f-0218-484f-a35b-abc85233579b/overview

Hybrid Analysis JS_TrojanDropper_Agent_PUC_trojan

Verdict:

Malicious

Labled as:

JS_TrojanDropper_Agent_PUC_trojan

Link:

https://www.hybrid-analysis.com/sample/e84c25dc709602462feecd1e686b5556a89de10f9cd3ea6af6a69dcdbcf7f591

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-14T08:02:00Z UTC

Last seen:

2026-07-17T05:27:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/e84c25dc709602462feecd1e686b5556a89de10f9cd3ea6af6a69dcdbcf7f591/results?tab=lookup

Joe Sandbox AgentTesla, DonutLoader

Result

Threat name:

AgentTesla, DonutLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1942674

Signature

Hides threads from debuggers

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected AgentTesla

Yara detected DonutLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e84c25dc709602462feecd1e686b5556a89de10f9cd3ea6af6a69dcdbcf7f591

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/e84c25dc709602462feecd1e686b5556a89de10f9cd3ea6af6a69dcdbcf7f591/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5bgclxdqsybeml7ozupgq22vk2uj3yipttj6u2xwu2o43phx6wiq._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

0041750b145156664772aef035961d7723957fe70a15a1563129224106d09769

AgentTesla

6c0474d7cf20a8a8ced7f9a5a59609ee58245a9a413e73d1738dad13f85d7f2b

AgentTesla

8da9fd778e01e2089de2c8874a80489b0c42afbc3f7499f4a5e6b6cd5c1ca658

AgentTesla

b1407ede7cf6976b4d234573be97175987019fceacfd76141f4083cc731fc7f2

AgentTesla

b5c078c186f17edf92e101e8df4d49f0e89515f81ce4dbbcbb611e76417ca978

AgentTesla

d010314800912704efec2cca545328ef2eb9a97893c34271d92df69e207f4a7c

AgentTesla

e68e2cde02efea3eeaff3125e510ce5fba502d918e379ba0a1ed8f808079dc0d

AgentTesla

ebbee1d2030789e37bd47f5e1f5cac792af7c31c05a451d220e03672202c07ea

AgentTesla

efc5f23ff325be267fa80f88dbbf0abefc4f479b52a6c8b0dd4963c39f3bf177

AgentTesla

error

AgentTesla

+ 150 additional samples on MalwareBazaar

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260715-jarn1ahx5v/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Checks computer location settings

Executes dropped EXE

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e84c25dc709602462feecd1e686b5556a89de10f9cd3ea6af6a69dcdbcf7f591