MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30cb3d0f6e29058d74e4b70d429625c9f1fd4836490c0f3f03eb808e5e3a41b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	30cb3d0f6e29058d74e4b70d429625c9f1fd4836490c0f3f03eb808e5e3a41b8
SHA3-384 hash:	84cb3cee8fa4883511d86ad2d2033a805aa1849b317ad617aade614d40f7ff2b358f53e1fe4b1c7e1295d496327d093e
SHA1 hash:	8c72068cf5cb5caba18238dbede4f94d6d74461f
MD5 hash:	60ac7f54aaa2f6b4b51dca6c49b7cd60
humanhash:	apart-batman-april-lithium
File name:	CopilotDrivers.js
Download:	download sample
File size:	466'300 bytes
First seen:	2025-09-03 18:14:30 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:OusDDBfyx5+1jdUrSLk/6uvucusDDBfyx5+1jdUrSLk/6uvh:/shyx5L0k/6Vshyx5L0k/6A
TLSH	T198A474D1F6A736C2ACC0CA57A750F6F8A13710B2AA465531D3FCD72AD0700679BCD9A2
Magika	scss
Reporter	abuse_ch
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

56

Origin country :

SE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68b885d83e988eb6ab83a982

Tags:

obfuscate xtreme spawn

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 evasive fingerprint obfuscated obfuscated powershell

Link:

https://www.filescan.io/uploads/68b885e21c81c34281dd58db/reports/a4b378f7-0559-4229-aac5-a2f60798c502/overview

Hybrid Analysis Trojan.Script.Dropper

Verdict:

Malicious

Labled as:

Trojan.Script.Dropper

Link:

https://www.hybrid-analysis.com/sample/30cb3d0f6e29058d74e4b70d429625c9f1fd4836490c0f3f03eb808e5e3a41b8

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2025-09-03T12:34:00Z UTC

Last seen:

2025-09-03T12:34:00Z UTC

Hits:

~10

Detections:

Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/30cb3d0f6e29058d74e4b70d429625c9f1fd4836490c0f3f03eb808e5e3a41b8/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1770641

Signature

Creates processes via WMI

Found Tor onion address

JavaScript source code contains functionality to generate code involving a shell, file or stream

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

78%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/30cb3d0f6e29058d74e4b70d429625c9f1fd4836490c0f3f03eb808e5e3a41b8

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/30cb3d0f6e29058d74e4b70d429625c9f1fd4836490c0f3f03eb808e5e3a41b8/

Neiki Family.REMCOS

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/30cb3d0f6e29058d74e4b70d429625c9f1fd4836490c0f3f03eb808e5e3a41b8

ReversingLabs TitaniumCloud Script-JS.Trojan.Malgent

Threat name:

Script-JS.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-09-03 18:16:38 UTC

File Type:

Text (JavaScript)

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gdft2d3ofecy25hew4guffrfzhy72sbwjega6pyd5oai4xr2ig4a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/250903-wwac3avvhv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://archive.org/download/optimized_msi_20250821/optimized_MSI.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/30cb3d0f6e29058d74e4b70d429625c9f1fd4836490c0f3f03eb808e5e3a41b8