MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2209ca5ff3cc4e3d94c85f0d6958ec38dfb4a7198fff0a2055217a91f3ff4551. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2209ca5ff3cc4e3d94c85f0d6958ec38dfb4a7198fff0a2055217a91f3ff4551
SHA3-384 hash:	28e1390d07cfdfc452485af0878380d76016433ed991177e656feb663adfea675a8699e038561aa70dd4421970846aa2
SHA1 hash:	f14556c541627ba62fcc841ca5373f2aa81ab9b3
MD5 hash:	ade0da0514eeefcec1df544dea69df79
humanhash:	west-venus-mobile-may
File name:	14665237.rar
Download:	download sample
File size:	2'630 bytes
First seen:	2026-07-24 12:17:28 UTC
Last seen:	2026-07-24 12:38:23 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	48:QlI21oWRfCHsdIwUneIFiqhQ9oWGy0MtlSEoI8xyHMEJ+gvQl4LxS:XyoWRqdwfIFiqhjWG1MtE8i2w/9
TLSH	T10C513A95FD104390FAA15AF40A32F935C4B73E606C115346C60D84A148E8E9F67F9642
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	rar

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

52

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Other files 1

File name:	14665237.js
File size:	1'769'119 bytes
SHA256 hash:	790b6e858f3bcd3f6c561c38a755264cb8969d815ea4e0153409d1aec9e56702
MD5 hash:	00c412297fc6da161f71392bf7116ec6
MIME type:	text/plain

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/1e926350-af4c-4eb2-930d-dc31d9f51d43/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2209ca5ff3cc4e3d94c85f0d6958ec38dfb4a7198fff0a2055217a91f3ff4551

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-07-08T06:37:00Z UTC

Last seen:

2026-07-19T08:40:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2209ca5ff3cc4e3d94c85f0d6958ec38dfb4a7198fff0a2055217a91f3ff4551/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/ade0da0514eeefcec1df544dea69df79

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2209ca5ff3cc4e3d94c85f0d6958ec38dfb4a7198fff0a2055217a91f3ff4551/

ReversingLabs TitaniumCloud Script-JS.Trojan.Leonem

Threat name:

Script-JS.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-24 12:20:52 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

13 of 36 (36.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eie4ux7tzrhd3fgil4gwswhmhdp3jjyzr77quicvef5jd477iviq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/260724-p4h7lsyzds/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/2209ca5ff3cc4e3d94c85f0d6958ec38dfb4a7198fff0a2055217a91f3ff4551