MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed36d86261949b9af1608fa4b88d3df6f94e1dfce1df9a7df8e1af890466d4e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ed36d86261949b9af1608fa4b88d3df6f94e1dfce1df9a7df8e1af890466d4e2
SHA3-384 hash:	656f2b46cb9c12b2ac36c492eb1cd46fe8de4a0dd7ccd210886cad0ac8c17c081cb027f0f0b15268344f6ca834e3f96b
SHA1 hash:	68323dce3d42537559a4183619b528108222b0db
MD5 hash:	7156faf9838ae2e112edc129e74ddcd0
humanhash:	muppet-fillet-mobile-johnny
File name:	invoice_2026 & packing list.zip
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	2'317'809 bytes
First seen:	2026-07-14 09:39:52 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	49152:zyh2fzdTzMNG16lqo/HbhbI9JyiCOCz99hLBEAE9a:+hEZTzME0lqEbhEXy0mjLY9a
TLSH	T15DB533498B396C640DF6BAA493B3C4579D07F9ECD06BBDEF4B1F10A035209DAD768290
TrID	60.0% (.USDZ) Universal Scene Description Zipped AR format (generic) (6000/1/1) 40.0% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	JAMESWT_WT
Tags:	AgentTesla ftp-enogcaen-br-com zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

82

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	invoice_2026 & packing list.JS
File size:	5'841'289 bytes
SHA256 hash:	789843148af8202a575e81a00bb855e9c35f26fc8a1fb3b422bc75a257eac6bf
MD5 hash:	d18e57e802f8c3984588077736aa6a12
MIME type:	text/plain
Signature	AgentTesla

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/6992eb4e-9f5d-4b52-bfe8-0f601a98c616/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_fn39.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Foxhole.Zip_fn34.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a1c67d85a2e3b5e58e4b75c

Tags:

spawn lien blic hype

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/ed36d86261949b9af1608fa4b88d3df6f94e1dfce1df9a7df8e1af890466d4e2/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug downloader dropper evasive masquerade obfuscated obfuscated packed repaired xloader

Link:

https://www.filescan.io/uploads/6a5604578079de36a7fd9196/reports/ebd5f184-0592-4c3d-a02d-107dcadb0efb/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/ed36d86261949b9af1608fa4b88d3df6f94e1dfce1df9a7df8e1af890466d4e2

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-05-31T11:18:00Z UTC

Last seen:

2026-06-16T12:08:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/ed36d86261949b9af1608fa4b88d3df6f94e1dfce1df9a7df8e1af890466d4e2/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Zip Archive

Link:

https://app.malva.re/file/7156faf9838ae2e112edc129e74ddcd0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ed36d86261949b9af1608fa4b88d3df6f94e1dfce1df9a7df8e1af890466d4e2/

ReversingLabs TitaniumCloud Script-JS.Trojan.Ravartar

Threat name:

Script-JS.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-31 16:55:42 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader collection execution keylogger loader spyware stealer trojan

Link:

https://tria.ge/reports/260714-lvftcaat4l/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/ed36d86261949b9af1608fa4b88d3df6f94e1dfce1df9a7df8e1af890466d4e2