MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c221785fb4293c76115bb22d181b5bf70795a759a39be12b2d4bb84e088cc19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2c221785fb4293c76115bb22d181b5bf70795a759a39be12b2d4bb84e088cc19
SHA3-384 hash:	171581848f0460b44f36eebec269f639e0089063b66792650df9c1ccba11e40d47251dab35ebe9939745182ac3083049
SHA1 hash:	984dca94cfdbdbe9d411f6e8f4cb1cb43bad3ac0
MD5 hash:	08baaec1f4a01f054e95902eb489848d
humanhash:	kilo-quiet-cold-two
File name:	REQUEST FOR QUOTATION.js
Download:	download sample
Signature	PhantomStealer Alert Create hunting rule
File size:	813'587 bytes
First seen:	2026-08-21 08:39:21 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:ejJtKu1w/JORFDtn2u0sW8lfc1kG+ARs0t9nxTJipxX8ltOT+5GhOIg23hR1G//T:P
TLSH	T1BA051777C2FD2F7DC4275658CEBA3C0C98B054A10A4EF47AED3B64C5D87CAE966A0250
Magika	javascript
Reporter	abuse_ch
Tags:	js PhantomStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

138

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

downloader encrypted evasive obfuscated repaired

Link:

https://www.filescan.io/uploads/6a880ef46155b2eacf00bdd0/reports/383784ef-05b9-4dec-81db-3b5050b7585b/overview

Hybrid Analysis Generik.KWIWIIE trojan

Verdict:

Malicious

Labled as:

Generik.KWIWIIE trojan

Link:

https://www.hybrid-analysis.com/sample/2c221785fb4293c76115bb22d181b5bf70795a759a39be12b2d4bb84e088cc19

Joe Sandbox KeyLogger, MicroClip, Phantom stealer, T

Result

Threat name:

KeyLogger, MicroClip, Phantom stealer, T

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1961668

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

Bypasses PowerShell execution policy

Creates multiple autostart registry keys

Disable Task Manager(disabletaskmgr)

Disables the Windows task manager (taskmgr)

Found direct / indirect Syscall (likely to bypass EDR)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Tries to detect virtualization through RDTSC time measurements

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected AntiVM3

Yara detected chromElevator

Yara detected Keylogger Generic

Yara detected MicroClip

Yara detected Phantom stealer

Yara detected Telegram RAT

Yara detected TrojanRansom

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

20%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/2c221785fb4293c76115bb22d181b5bf70795a759a39be12b2d4bb84e088cc19

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2c221785fb4293c76115bb22d181b5bf70795a759a39be12b2d4bb84e088cc19/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fqrbpbp3ikj4oyivxmrndanvx5yhswtvti434evs2s5yjyeizqmq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

collection defense_evasion discovery evasion execution persistence ransomware spyware stealer trojan

Link:

https://tria.ge/reports/260821-kk16vsbk4s/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

outlook_office_path

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Badlisted process makes network request

Modifies Windows Defender DisableAntiSpyware settings

Modifies Windows Defender Real-time Protection settings

Windows security bypass

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.