MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec28fa6cc4dc26dc65e882b52dfbf497cd97ce7fe8b2b9438b4647401b38e0b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ec28fa6cc4dc26dc65e882b52dfbf497cd97ce7fe8b2b9438b4647401b38e0b3
SHA3-384 hash:	e729029f4be9234f667dc6f7d716864b3528c71558261ede60d7bc57cbfb69a9e2f7840a27be031f90ad1f33570ff58c
SHA1 hash:	8a779a4b2e7f8de7c56c51c5c3aa576dc549ad24
MD5 hash:	2cdc31039ca26bbf2d7a80c3422312a6
humanhash:	pizza-avocado-football-robert
File name:	Purchase order PN0001.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	3'293'663 bytes
First seen:	2026-07-14 10:24:04 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:zJyJDn2NoohUcasuTCtOI0tGcvKtX6aPgkXh9HL6M1azr:zJgzSUcZX04cvIo69HL6qav
Threatray	223 similar samples on MalwareBazaar
TLSH	T1C8E5E6119764A5727364E7AC513BDE38984E600329EACF4530AFC338792ED4B9748BE7
Magika	javascript
Reporter	nat
Tags:	AgentTesla js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

131

Origin country :

TH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a560e6b56bd89099b55365c

Tags:

vmdetect virus agent blic

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive masquerade obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a560e6140e5adcf96dde8bf/reports/a4a9c355-c37e-491f-8877-2fd86f2a2dad/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ec28fa6cc4dc26dc65e882b52dfbf497cd97ce7fe8b2b9438b4647401b38e0b3

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-12T20:03:00Z UTC

Last seen:

2026-07-14T07:01:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/ec28fa6cc4dc26dc65e882b52dfbf497cd97ce7fe8b2b9438b4647401b38e0b3/results?tab=lookup

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ec28fa6cc4dc26dc65e882b52dfbf497cd97ce7fe8b2b9438b4647401b38e0b3

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/ec28fa6cc4dc26dc65e882b52dfbf497cd97ce7fe8b2b9438b4647401b38e0b3/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-13 01:04:37 UTC

File Type:

Text (JavaScript)

AV detection:

9 of 36 (25.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5qupu3ge3qtnyzpiqk2s367us7gzptt75czlsq4lizduagzy4czq._file

Threatray agenttesla donutloader

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

donutloader

Alert

Create hunting rule

Similar samples:

147c897e00c759b643fb5dd6afc05be16433f78ecb5ff563f767721c6b502fdd

AgentTesla

1497f3ac5cea6ff1326aff8c3e774fe5a67dff656d1fb9e212307bad5300d9fe

AgentTesla

22664b468509d5a3ef8d156c623b64fd1acf1ebb19d175af6990cfac6178b557

AgentTesla

2e264065cf67a4b630a899e8fad202e0a6b8a3158e9f01e904b482d200986484

AgentTesla

5060df36d2b6701839279f5ac009ecf132a4659afd568eafcfa3a215a2b734e8

AgentTesla

53f74990bfd6bf39940b96e2bcf1ae5fc435d1a27b492b8fb128291b06f53b72

AgentTesla

76e089a21b93f2349ca1dacfd8d4fae4b57702f302103a83ca7c0d988991100e

AgentTesla

c835a3ad655dfbcb2702c257019c549a3706b9331421cb35bd68f612d89f8263

AgentTesla

+ 213 additional samples on MalwareBazaar

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader collection execution keylogger loader persistence spyware stealer trojan

Link:

https://tria.ge/reports/260714-mfnfbads8x/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VMRay AgentTesla

Malware family:

AgentTesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ec28fa6cc4dc/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/ec28fa6cc4dc26dc65e882b52dfbf497cd97ce7fe8b2b9438b4647401b38e0b3