MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28359d2d8054f8650bfdb99aa395ef2bba62846005e3f4748b2aca8f173f8bcb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	28359d2d8054f8650bfdb99aa395ef2bba62846005e3f4748b2aca8f173f8bcb
SHA3-384 hash:	23f285019de4b27f169a09d630edcd63da1810585c39e2c06939dfb22e78847eec23a362d02bb07d65e54f846236a443
SHA1 hash:	0990c8cfa97a5ad7e1a0cba45cb51456df39fdaa
MD5 hash:	ea38b7ce3db67ad4398028718af6b0e3
humanhash:	two-coffee-harry-mirror
File name:	RFQ Q26-1149.JS
Download:	download sample
Signature	PhantomStealer Alert Create hunting rule
File size:	3'954'650 bytes
First seen:	2026-08-05 12:15:50 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:YpQRiM1arm2HEBz9lg8U1vIcF/nqaH04XwIEqg7oaCg3nrB1Hx5fEo:YpQE/2TgNvtM4vEqgxVd1R5
TLSH	T15506C381274491337321AB9C5336DAB2D92E12A314C6DB0A717DE2197F7CD0BE358AF6
Magika	javascript
Reporter	James_inthe_box
Tags:	exe js PhantomStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

169

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.29031.BadJs.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Rogue.0hr.20260802-2233.UNOFFICIAL

Alert

Create hunting rule

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/28359d2d8054f8650bfdb99aa395ef2bba62846005e3f4748b2aca8f173f8bcb

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-02T17:34:00Z UTC

Last seen:

2026-08-07T10:35:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/28359d2d8054f8650bfdb99aa395ef2bba62846005e3f4748b2aca8f173f8bcb/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/28359d2d8054f8650bfdb99aa395ef2bba62846005e3f4748b2aca8f173f8bcb

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/28359d2d8054f8650bfdb99aa395ef2bba62846005e3f4748b2aca8f173f8bcb/

ReversingLabs TitaniumCloud Script-JS.Trojan.Kepavll

Threat name:

Script-JS.Trojan.Kepavll

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-03 02:33:41 UTC

File Type:

Text (JavaScript)

AV detection:

16 of 36 (44.44%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fa2z2lmakt4gkc75xgnkhfppfo5gfbdaaxr7i5elflfi6fz7rpfq._file

Threatray ChromElevator DonutLoader PhantomStealer

Verdict:

malicious

Label(s):

ChromElevator

Alert

Create hunting rule

DonutLoader

Alert

Create hunting rule

PhantomStealer

Alert

Create hunting rule

Link:

https://reports.threatray.com/fb9038de-7726-485c-8c7a-9b80f084a763

Hatching Triage phantom_stealer

Result

Malware family:

phantom_stealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:phantom_stealer collection discovery execution loader persistence spyware stealer

Link:

https://tria.ge/reports/260805-pfppgsxbma/

Behaviour

Checks processor information in registry

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Downloads MZ/PE file

Detects DonutLoader

Family: DonutLoader

Family: PhantomStealer

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/28359d2d8054f8650bfdb99aa395ef2bba62846005e3f4748b2aca8f173f8bcb