MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f184acaa8821f13f2eee56c390b83d2b6948f10ce768cd23ac6e56e3fa708e61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f184acaa8821f13f2eee56c390b83d2b6948f10ce768cd23ac6e56e3fa708e61
SHA3-384 hash:	6e1889c3fd1e64b32c46cc713a0f6303c4acef6c84a5be570876be743f6778d0a3e60e362c012119b14e186cda7876de
SHA1 hash:	e1c5a0ee07efaed78dbaa15697c2f655496a035e
MD5 hash:	0ae87c430da0ab4d3d9736d8ce73589a
humanhash:	berlin-johnny-rugby-batman
File name:	comprobante de pago.js
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	853'306 bytes
First seen:	2026-08-03 12:13:31 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:frqHJGuWHKf6j2/oD3xGnlpTFOzfaH4Pg2g1b3i9:KGuWHm4E2slCLaH4o2g1b3i9
TLSH	T132051FB26389A5C1DABB63C3ED8AB7299590450BCAC2B71F3FAC87C314458DD1690CF5
Magika	javascript
Reporter	James_inthe_box
Tags:	AgentTesla exe js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

67

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6a7099012d4ff8fd0db010b0/reports/ffae128a-fcf5-4714-ace0-f1b5cbfa2b96/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f184acaa8821f13f2eee56c390b83d2b6948f10ce768cd23ac6e56e3fa708e61

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-31T11:13:00Z UTC

Last seen:

2026-08-03T09:07:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/f184acaa8821f13f2eee56c390b83d2b6948f10ce768cd23ac6e56e3fa708e61/results?tab=lookup

Nucleon Malprob Benign

Score:

28%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/f184acaa8821f13f2eee56c390b83d2b6948f10ce768cd23ac6e56e3fa708e61

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f184acaa8821f13f2eee56c390b83d2b6948f10ce768cd23ac6e56e3fa708e61/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-08-01 07:16:14 UTC

File Type:

Binary

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6gckzkuiehyt6lxok3bzbob5fnuur4im45um2i5mnzloh6tqrzqq._file

Threatray AgentTesla

Verdict:

malicious

Label(s):

AgentTesla

Alert

Create hunting rule

Link:

https://reports.threatray.com/491671ef-2cb5-4024-8a44-6f94ae6edf76

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection discovery execution keylogger persistence privilege_escalation spyware stealer trojan

Link:

https://tria.ge/reports/260803-pelw7shc49/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Creates a file in the Startup directory

Badlisted process makes network request

Family: AgentTesla

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.85

Link:

https://yomi.yoroi.company/submissions/f184acaa8821f13f2eee56c390b83d2b6948f10ce768cd23ac6e56e3fa708e61