MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eaf3dc2c2daed81473f7fc5067990ffda4cd2e53a52bd31563da6fb3358d4fc3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	eaf3dc2c2daed81473f7fc5067990ffda4cd2e53a52bd31563da6fb3358d4fc3
SHA3-384 hash:	8d1c70694bbbe38cad5a9a7cd399049e99d0326a744cde9466d02ef4621d69123b454eb9c2c212ccf50b3fa245930a1c
SHA1 hash:	ef8d37bf7a899e09fc24d15231bfbf26674b8294
MD5 hash:	74715de747cf8ebf937d8c6519b4cd4a
humanhash:	oranges-ceiling-helium-fruit
File name:	Orden de compra.js
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	1'064'174 bytes
First seen:	2026-08-18 17:09:25 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:GKtHUlNlKL+6i2oiHwwX/Ulr6iLcIwOKtHX/McIX/tHvLcIwOKtHtHX/ZoI6GDL9:Ps7QX4M3B1
TLSH	T155359F12661AD89745A1690CDF20B7FCEF3426B5ABDE2EC51783A7C927BC681C5DC830
Magika	javascript
Reporter	James_inthe_box
Tags:	AgentTesla exe js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

214

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.32504.JsHeur.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

obfuscated repaired

Link:

https://www.filescan.io/uploads/6a8491d01691959ccc51faed/reports/bd79728b-88de-4d8d-8fb3-9dfc0de6ea79/overview

Hybrid Analysis JS/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

JS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/eaf3dc2c2daed81473f7fc5067990ffda4cd2e53a52bd31563da6fb3358d4fc3

Nucleon Malprob Benign

Score:

21%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/eaf3dc2c2daed81473f7fc5067990ffda4cd2e53a52bd31563da6fb3358d4fc3

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/eaf3dc2c2daed81473f7fc5067990ffda4cd2e53a52bd31563da6fb3358d4fc3/

ReversingLabs TitaniumCloud Win32.Spyware.Negasteal

Threat name:

Win32.Spyware.Negasteal

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-18 17:09:53 UTC

File Type:

Binary

AV detection:

8 of 24 (33.33%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5lz5ylbnv3mbi47x7rigpgip7wsm2lstuuv5gfld3jx3gnmnj7bq._file

Threatray AgentTesla

Verdict:

malicious

Label(s):

AgentTesla

Alert

Create hunting rule

Link:

https://reports.threatray.com/d8f843b0-7e45-40c8-826a-a90f35803d4d

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection discovery execution keylogger persistence privilege_escalation spyware stealer trojan

Link:

https://tria.ge/reports/260818-vpetjawgkg/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Creates a file in the Startup directory

Badlisted process makes network request

Family: AgentTesla

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://sunix-technology.com/images/MSI_PRO.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.