MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ee7da2bc52fa3b794ad34788e87a0aa76dca6f43805fb9cf636f02ac87ebe0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ee7da2bc52fa3b794ad34788e87a0aa76dca6f43805fb9cf636f02ac87ebe0b
SHA3-384 hash: 0212177fead0e9bcd2ba3d619746cc4005dc0e32ab28792670e29b9a665c490baf3ad0c4f0a6160e6adf18db9207307f
SHA1 hash: c389c56b97072ffe0b9e039cebd4817df27c5d16
MD5 hash: 61d2fd1ec45a1ce7cc0d3f7aac9362a0
humanhash: single-lamp-ohio-bluebird
File name:obf - Copy.js
Download: download sample
File size:12'896 bytes
First seen:2026-06-30 17:47:33 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 384:Zy1cZOjFQAybwka0UoV86wWBuArHlQUYey:ZYcZORQAybXKoOKuADCUY
TLSH T124426B8A3C43FCF513A53A83EEEF24F2EC16985549AA4545486FF7310229BC62C176E7
Magika javascript
Reporter James_inthe_box
Tags:exe js

Intelligence

File Origin
# of uploads :
1
# of downloads :
175
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a44017286bc95245bfaf403
Tags:
trojan shell agent
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
base64 repaired
Link:
https://www.filescan.io/uploads/6a44016b3dc56e40aba3ac5e/reports/1295bde0-2b44-4dbc-aba1-77545f0bde94/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/2ee7da2bc52fa3b794ad34788e87a0aa76dca6f43805fb9cf636f02ac87ebe0b
Verdict:
Malicious
File Type:
js
First seen:
2026-06-30T14:57:00Z UTC
Last seen:
2026-07-01T05:42:00Z UTC
Hits:
~100
Detections:
PDM:Trojan.Win32.Generic Trojan.Win32.Agent.sb HEUR:Trojan.Script.Generic Trojan.Win32.Garvi.a NetTool.PowerShellUA.HTTP.C&C NetTool.PowerShellGet.HTTP.C&C
Link:
https://opentip.kaspersky.com/2ee7da2bc52fa3b794ad34788e87a0aa76dca6f43805fb9cf636f02ac87ebe0b/results?tab=lookup
Score:
95%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/2ee7da2bc52fa3b794ad34788e87a0aa76dca6f43805fb9cf636f02ac87ebe0b
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ee7da2bc52fa3b794ad34788e87a0aa76dca6f43805fb9cf636f02ac87ebe0b/
Verdict:
Malicious
Threat:
NetTool.Win32.HTTP
Link:
https://tip.neiki.dev/file/2ee7da2bc52fa3b794ad34788e87a0aa76dca6f43805fb9cf636f02ac87ebe0b
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f3t5uk6ff6r3pffngr4i5b5avj3nzjxuhac7xhhwg3ycvsd6xyfq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
adware discovery execution persistence spyware
Link:
https://tria.ge/reports/260630-wdngzaes5y/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Adds Run key to start application
Checks computer location settings
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ee7da2bc52fa3b794ad34788e87a0aa76dca6f43805fb9cf636f02ac87ebe0b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments