MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01aa6dc2f5dff9842b4b89b74f0f38e8d45d32db418e07472658de84de70c3c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	01aa6dc2f5dff9842b4b89b74f0f38e8d45d32db418e07472658de84de70c3c4
SHA3-384 hash:	3f9a57d8c6b394c435669b6aa0db2049afa2fb2ef2740f4c6288f60f626d4628537def9345404431d1ecd0b8f13eb50c
SHA1 hash:	970d40815a874c7b225ee768edc0acad9b336dc7
MD5 hash:	6b9644841e4d3bb9802aac5bfd191657
humanhash:	georgia-solar-violet-mississippi
File name:	81743320260910_103754_9acb7cdd20.js
Download:	download sample
File size:	1'295'638 bytes
First seen:	2026-09-10 10:46:27 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	24576:KYBZSyjr0EF9WWnPI4pxGYBZSyjr0EF9WWnPI4pxhYBZSyjr0EF9WWnPI4pxGYBU:KYBZSyjr0EF9WWnPI4pxGYBZSyjr0EFJ
TLSH	T1AF555325713E9308B0A391CC95EE17524EB6F7AA263F07AC82726D9C23D3D024ED5B57
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	KodaDr
Tags:	Downloader js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

76

Origin country :

LV

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac956d835f675519f380052

Tags:

infosteal phishing belarus rapid

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 downloader encrypted fingerprint ipconfig lolbin netsh powershell powershell repaired

Link:

https://www.filescan.io/uploads/6aa28aad5937d994350137ba/reports/822cf3a2-8237-4487-a30c-3f8ea2f5d14d/overview

Hybrid Analysis JS/Agent.EZP

Verdict:

Suspicious

Labled as:

JS/Agent.EZP

Link:

https://www.hybrid-analysis.com/sample/01aa6dc2f5dff9842b4b89b74f0f38e8d45d32db418e07472658de84de70c3c4

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-09-10T08:44:00Z UTC

Last seen:

2026-09-10T14:54:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/01aa6dc2f5dff9842b4b89b74f0f38e8d45d32db418e07472658de84de70c3c4/results?tab=lookup

Nucleon Malprob Malware

Score:

87%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/01aa6dc2f5dff9842b4b89b74f0f38e8d45d32db418e07472658de84de70c3c4

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/01aa6dc2f5dff9842b4b89b74f0f38e8d45d32db418e07472658de84de70c3c4/

ReversingLabs TitaniumCloud Script-JS.Trojan.UpCrypter

Threat name:

Script-JS.Trojan.UpCrypter

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-10 10:47:19 UTC

File Type:

Text (VBS)

AV detection:

4 of 24 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=agvg3qxv374yik2lrg3u6dzy5dkf2mw3ighaorzgldpijxtqypca._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution persistence privilege_escalation

Link:

https://tria.ge/reports/260910-mvpa6abk2w/

Behaviour

Gathers network information

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Deletes itself

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/01aa6dc2f5dff9842b4b89b74f0f38e8d45d32db418e07472658de84de70c3c4