MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5c16770962c280e371a0e612e16f467db0fb294774a42d7dd6161d24b151eeb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f5c16770962c280e371a0e612e16f467db0fb294774a42d7dd6161d24b151eeb
SHA3-384 hash:	be6e87fc50862312d609de0505eb881164eef67a7289a7df2e106ad123ba7a32c9378be7cfe7b1f60163a9e094747423
SHA1 hash:	f4df8b289d5dc6b7efd261d8baad4e43273b201d
MD5 hash:	3aadff2a36b874a439ba1d97abc2f103
humanhash:	salami-utah-harry-one
File name:	Solicitud_de_cotizacion_-_20150813-523838075605.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	3'410'538 bytes
First seen:	2026-08-18 19:05:31 UTC
Last seen:	2026-08-18 19:07:57 UTC
File type:	js
MIME type:	text/plain
ssdeep	98304:tlARXLmp4TRhlJ1KHK1DhXL7qgX49eMkSiIwCme1DPiHlJWPSIanYGcNsXMR3OOY:tlARXLmp4TRhlJ1KHK1DhXL7qgX49eMO
TLSH	T16AF5F8A11BCE51233B71ABDA4139DD30E20ECA1715449B16B7FCEE183B6CD14A718BB6
Magika	javascript
Reporter	TomU
Tags:	AgentTesla js

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

157

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.29031.BadJs.UNOFFICIAL

Alert

Create hunting rule

Hybrid Analysis GT:JS.ObfLoader.3

Verdict:

Malicious

Labled as:

GT:JS.ObfLoader.3

Link:

https://www.hybrid-analysis.com/sample/f5c16770962c280e371a0e612e16f467db0fb294774a42d7dd6161d24b151eeb

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f5c16770962c280e371a0e612e16f467db0fb294774a42d7dd6161d24b151eeb

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/f5c16770962c280e371a0e612e16f467db0fb294774a42d7dd6161d24b151eeb/

ReversingLabs TitaniumCloud Script-JS.Trojan.Malgent

Threat name:

Script-JS.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-04 16:43:42 UTC

File Type:

Text (JavaScript)

AV detection:

13 of 24 (54.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6xawo4ewfqua4ny2bzqs4fxum7nq7muuo5fefv65mfq5esyvd3vq._file

Threatray AgentTesla

Verdict:

malicious

Label(s):

AgentTesla

Alert

Create hunting rule

Link:

https://reports.threatray.com/45063397-0685-47ae-bfd3-090d5998b1a0

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection discovery execution keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/260818-xr2gesgj4y/

Behaviour

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f5c16770962c280e371a0e612e16f467db0fb294774a42d7dd6161d24b151eeb