MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 358346be7566fc2ffb13141eabc5af270a9e0e8f71fa99aebc6a5b5d6281a101. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 358346be7566fc2ffb13141eabc5af270a9e0e8f71fa99aebc6a5b5d6281a101
SHA3-384 hash: de7d7a74cf468bced25ddae5d74b5f959289dcc19fb4558cc4e104432f68ff2605505330df1d45875ac5fec82ed79e49
SHA1 hash: 96a3f5d910097886e0f12306dcc94935d5e9f754
MD5 hash: 6759aaf980bd76dba671000a98eb5046
humanhash: missouri-alpha-oven-moon
File name:358346be7566fc2ffb13141eabc5af270a9e0e8f71fa99aebc6a5b5d6281a101.js
Download: download sample
File size:989'094 bytes
First seen:2026-05-14 19:53:33 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 6144:l4AysO6zeKJzzt4bNlQ7NrAPDPNz0h3OP2VH5E/6H/gp2ooSieehwiD:l86zhJzzt4bN6uZz0UCZE/0/gp2ZXas
Threatray 10 similar samples on MalwareBazaar
TLSH T14525303DDAE8001DF5B28A10BDB4041FE466BF56652D899F11C1154F4E32A0DBBAEB3E
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika html
Reporter JAMESWT_WT
Tags:184-95-51-188 js sterlingreservewealth-info

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a06287946d6967b3d9059de
Tags:
autorun shell virus spawn
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
conhost crypt encrypted evasive powershell repaired
Link:
https://www.filescan.io/uploads/6a06287486e92bda70305970/reports/6a6d5143-aebf-4a48-9252-56c2963a6772/overview
Verdict:
Malicious
Labled as:
Trojan.Cryxos.JS
Link:
https://www.hybrid-analysis.com/sample/358346be7566fc2ffb13141eabc5af270a9e0e8f71fa99aebc6a5b5d6281a101
Verdict:
Malicious
File Type:
js
First seen:
2026-05-13T19:51:00Z UTC
Last seen:
2026-05-15T16:09:00Z UTC
Hits:
~1000
Detections:
HEUR:Trojan.Script.Generic PDM:Trojan.Win32.Generic HEUR:Trojan-Downloader.Script.Generic
Link:
https://opentip.kaspersky.com/358346be7566fc2ffb13141eabc5af270a9e0e8f71fa99aebc6a5b5d6281a101/results?tab=lookup
Score:
51%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/358346be7566fc2ffb13141eabc5af270a9e0e8f71fa99aebc6a5b5d6281a101
Verdict:
inconclusive
YARA:
1 match(es)
Link:
https://app.malva.re/file/6759aaf980bd76dba671000a98eb5046
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/358346be7566fc2ffb13141eabc5af270a9e0e8f71fa99aebc6a5b5d6281a101/
Verdict:
Malicious
Threat:
Trojan.Script
Link:
https://tip.neiki.dev/file/358346be7566fc2ffb13141eabc5af270a9e0e8f71fa99aebc6a5b5d6281a101
Threat name:
Script-JS.Trojan.Cryxos
Create hunting rule
Status:
Malicious
First seen:
2026-05-13 22:48:00 UTC
File Type:
Text (JavaScript)
AV detection:
10 of 36 (27.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gwbunptvm36c76ytcqpkxrnpe4fj4dupoh5jtlv4njnv2yubueaq._file
Verdict:
malicious
Label(s):
purecrypter
Create hunting rule
stubrunner
Create hunting rule
Similar samples:
2003bb24fba6a50570bf6cbdecc84549a9cf47849ffcd5250a8b5390751c5707
2ead3b4303a43796d7de2cf5fbd28743b3e1cf9690626ae575d360c474fb0639
500592a2cfd2536eeac2bd102bd56bb2c5f5fb4aff3c15239c6b9b8113c5f2d7
57f4cdc0363e85d6542a2473eb252711dfc1667d6a2875d2c507fc817bced680
9b6b53ffc24cf8ca9350321c1b073a7ff034eca45020453af607be0d455d47dd
9d34b9747ceb4a2a40f23df7e3f91fa3a96cac6f1931cdb2081ca5b84a81c6cc
ba6576128e1ff343101834b5c3b61cfd6b02089ad4977f0b7226ea3c345fa6b9
error
Gathering data
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/358346be7566fc2ffb13141eabc5af270a9e0e8f71fa99aebc6a5b5d6281a101

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments