MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f275be8ed40ec5bdfe9d4a46f784ea513f30aa8d699a48a3dd71eca95d40376d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f275be8ed40ec5bdfe9d4a46f784ea513f30aa8d699a48a3dd71eca95d40376d
SHA3-384 hash:	5e55c40113848ccdae080948ce49983e073a6f3297820c6c9039496b658919b091b7c0d260ae270bbf26a6d1ce119f84
SHA1 hash:	bb3b98061f79f77376fa9ba75c13210bd58df2ce
MD5 hash:	29d4535c12457825e8e1613b6965637a
humanhash:	beryllium-oregon-december-pennsylvania
File name:	29d4535c12457825e8e1613b6965637a.js
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	1'190'542 bytes
First seen:	2026-03-18 09:46:31 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	1536:Zccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccx:R
Threatray	3'683 similar samples on MalwareBazaar
TLSH	T1DF4568F75887AEDB49868DC4162A21ECAB0D6DDB2302DD6E34B0CFDF829112ED24575C
Magika	javascript
Reporter	abuse_ch
Tags:	AgentTesla js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

139

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Clean

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69ba74bc88c80c01586b9463

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 evasive fingerprint obfuscated obfuscated overlay packed powershell repaired

Link:

https://www.filescan.io/uploads/69ba7486493cb7d62d03fa6f/reports/6a49523a-c2a4-4ab4-9553-bbec18066a05/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f275be8ed40ec5bdfe9d4a46f784ea513f30aa8d699a48a3dd71eca95d40376d

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Detections:

Trojan-Downloader.Agent.HTTP.C&C Trojan.JS.SAgent.sb HEUR:Trojan.Script.SAgent.gen HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/f275be8ed40ec5bdfe9d4a46f784ea513f30aa8d699a48a3dd71eca95d40376d/results?tab=lookup

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1885488

Signature

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Creates processes via WMI

Found malware configuration

Injects a PE file into a foreign processes

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

8%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/f275be8ed40ec5bdfe9d4a46f784ea513f30aa8d699a48a3dd71eca95d40376d

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/f275be8ed40ec5bdfe9d4a46f784ea513f30aa8d699a48a3dd71eca95d40376d/

Neiki Family.REMCOS

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/f275be8ed40ec5bdfe9d4a46f784ea513f30aa8d699a48a3dd71eca95d40376d

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6j235dwub3c337u5jjdppbhkke7tbkunngneri65ohwksxkag5wq._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

638a1726e770addef6a1c4fa36332fc1183d2e8434b5f47c91df5c14ef7ae68e

AgentTesla

7101b18d8de608de1c618f221e5bbab6c95973b0a1088c28f384ba3e9c008488

AgentTesla

86eee13b0f15128914c9ac0b54a99f4f22a5a755593ad7ee846fdc886e3d5683

AgentTesla

b6435d167628a91820c8440d2fbf10fe6f823e64c33a597eca56021322c47bb4

AgentTesla

ce8cdbdac7f2dc6b5b8068a910e3309c97bf897904753447ed842d4fef60cdb6

AgentTesla

d5f36995dfc44e102f37faa200f0bbb4cffe348a658fd8a3ee019168b1caf9ce

AgentTesla

error

AgentTesla

+ 3'673 additional samples on MalwareBazaar

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260318-lrzgaafv3x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

AgentTesla

Agenttesla family

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/f275be8ed40ec5bdfe9d4a46f784ea513f30aa8d699a48a3dd71eca95d40376d