MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ef2d3beb60a0fc121aea1386af55c6eb50a15c9313b7a0a7f2726be013af81f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 8
| SHA256 hash: | ef2d3beb60a0fc121aea1386af55c6eb50a15c9313b7a0a7f2726be013af81f9 |
|---|---|
| SHA3-384 hash: | bf6bc2d46c0d9c7048a65c6f3cf864140fea86f4e0ace3ebdb9ede2bdfa60b6285d974ba628b1dca6813daf3d9c1ee35 |
| SHA1 hash: | 498a01e1371adcb1c32cb21ae7f094669d476793 |
| MD5 hash: | 63deb82c05e509f872166cd06dea15ac |
| humanhash: | eighteen-potato-nitrogen-south |
| File name: | Bank_Slip.rar |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 1'532'644 bytes |
| First seen: | 2026-06-02 15:47:40 UTC |
| Last seen: | 2026-06-08 14:48:04 UTC |
| File type: | rar |
| MIME type: | application/x-rar |
| ssdeep | 24576:Ev3xHMYirKGjXi545veBsfLsQZczNvJKOTsvRCA362v7CCDhTspnwRBwP37JWIJP:EPxNirKGjS5nBsTS/KOqdvWwRWPrJOr4 |
| TLSH | T19B653359F4E1E26343C0088CDC7BC465F9B1DF6DB0F9099A7B20C4E5A5B7E2A422A352 |
| TrID | 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1) |
| Magika | rar |
| Reporter |  TomU |
| Tags: | AgentTesla rar |
Intelligence
File Origin
# of uploads :
7
# of downloads :
113
Origin country :
CHFile Archive Information
This file archive contains 1 file(s), sorted by their relevance:
| File name: | Bank Slip.JS |
|---|---|
| File size: | 5'843'105 bytes |
| SHA256 hash: | 3869c3207197e8fd9633d6a2e5f198846883015b3812d81fca8ff699444f5b16 |
| MD5 hash: | 1166871fb09c5980e536381647af186a |
| MIME type: | text/plain |
| Signature | AgentTesla |
Vendor Threat Intelligence
Verdict:
Malicious
Score:
96.5%
Tags:
muldrop virus lien blic
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-debug dropper evasive obfuscated obfuscated packed repaired
Verdict:
Malicious
File Type:
rar
First seen:
2026-06-01T14:30:00Z UTC
Last seen:
2026-06-04T10:05:00Z UTC
Hits:
~10
Gathering data
Threat name:
Script-JS.Trojan.Kepavll
Status:
Malicious
First seen:
2026-06-01 19:15:28 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
10 of 24 (41.67%)
Threat level:
5/5
Result
Malware family:
donutloader
Score:
10/10
Tags:
family:agenttesla family:donutloader collection execution keylogger loader spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Detects DonutLoader
Family: AgentTesla
Family: DonutLoader
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.70
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
AgentTesla
rar ef2d3beb60a0fc121aea1386af55c6eb50a15c9313b7a0a7f2726be013af81f9
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.