🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 412fe46d202ca9907bc167cf3f8ef7ee558e49af623c3b0a681f8efe56537bdc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 412fe46d202ca9907bc167cf3f8ef7ee558e49af623c3b0a681f8efe56537bdc
SHA3-384 hash: e23fded40498d209a047eb899a5a35f59292717dd47b0697d6a821acc9494e5af099951c61ed59e9a4af9b18135a5143
SHA1 hash: da917e10ab7354b94bd68a0d8d5775f19a9d3b8d
MD5 hash: 80cf319d056dbe030409cb0194f704e8
humanhash: spring-robert-gee-orange
File name:ORDER.js
Download: download sample
File size:5'524 bytes
First seen:2026-11-04 10:51:48 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:application/javascript
ssdeep 96:L3p8eCwAxRn8W0cD2sx7uD+GRst5WHJSUfdugCG5+0/:LZtBAPnp5xWda5XU1L
TLSH T131B11F9D9C52E0A58937F33ECF6BC208E76744630502D162B6EC85542F715A880EDEFD
Magika javascript
Reporter abuse_ch
Tags:js

Intelligence

File Origin
# of uploads :
1
# of downloads :
163
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Script.SNH-gen.65236774.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6aeb0e7d3970fcef1e4b028b
Tags:
autorun proxy rapid java
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Connection attempt to an infection source
Sending an HTTP GET request
DNS request
Connection attempt
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Sending a custom TCP request
Launching a process
Creating synchronization primitives
Reading critical registry keys
Deleting a recently created file
Replacing files
Query of malicious DNS domain
Sending a TCP request to an infection source
Forced shutdown of a system process
Creating a file in the %AppData% subdirectories
Stealing user critical data
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Cryxos.JS
Link:
https://www.hybrid-analysis.com/sample/412fe46d202ca9907bc167cf3f8ef7ee558e49af623c3b0a681f8efe56537bdc
Verdict:
Malicious
File Type:
js
First seen:
2026-11-04T03:58:00Z UTC
Last seen:
2026-11-04T20:04:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/412fe46d202ca9907bc167cf3f8ef7ee558e49af623c3b0a681f8efe56537bdc/results?tab=lookup
Result
Threat name:
Aleta, Annabelle, Colossus, DarkCloud, D
Create hunting rule
Detection:
malicious
Classification:
rans.bank.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1998117
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Creates autostart registry keys with suspicious values (likely registry only malware)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
JavaScript source code contains functionality to generate code involving a shell, file or stream
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Aleta Ransomware
Yara detected Annabelle Ransomware
Yara detected Colossus Ransomware
Yara detected DarkCloud
Yara detected Drill Ransomware
Yara detected Erbium Stealer
Yara detected Generic JS Downloader
Yara detected Korplug
Yara detected LOCKFILE ransomware
Yara detected Mekotio
Yara detected Metamorfo
Yara detected Monkey Ransomware
Yara detected NOKOYAWA Ransomware
Yara detected PlugX
Yara detected Powershell decode and execute
Yara detected Prestige Ransomware
Yara detected Pyschedelic Ransomware
Yara detected RansomHub Ransomware
Yara detected RustyBuer Loader
Yara detected ShadowRoot Ransomware
Yara detected Telegram RAT
Yara detected White Rabbit Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1998117 Sample: ORDER.js Startdate: 04/11/2026 Architecture: WINDOWS Score: 100 44 showip.net 2->44 46 flicargo.com 2->46 52 Found malware configuration 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 Antivirus detection for URL or domain 2->56 58 29 other signatures 2->58 10 wscript.exe 2 22 2->10         started        15 powershell.exe 17 2->15         started        17 powershell.exe 2->17         started        19 powershell.exe 2->19         started        signatures3 process4 dnsIp5 48 flicargo.com 180.235.151.11, 443, 49738 ARDH-AS-IDARDHGLOBALINDONESIAPTID Indonesia 10->48 42 C:\Temp\IYBGWBDJCL.ps1, ASCII 10->42 dropped 66 System process connects to network (likely due to code injection or exploit) 10->66 68 JScript performs obfuscated calls to suspicious functions 10->68 70 Wscript starts Powershell (via cmd or directly) 10->70 72 5 other signatures 10->72 21 powershell.exe 16 10->21         started        24 conhost.exe 15->24         started        26 conhost.exe 17->26         started        28 conhost.exe 19->28         started        file6 signatures7 process8 signatures9 60 Writes to foreign memory regions 21->60 62 Found suspicious powershell code related to unpacking or dynamic code loading 21->62 64 Injects a PE file into a foreign processes 21->64 30 aspnet_compiler.exe 146 21->30         started        34 conhost.exe 21->34         started        36 aspnet_compiler.exe 21->36         started        process10 dnsIp11 50 showip.net 162.55.60.2, 443, 49744, 49745 HETZNER-ASDE Germany 30->50 74 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 30->74 76 Tries to steal Mail credentials (via file / registry access) 30->76 78 Tries to harvest and steal browser information (history, passwords, etc) 30->78 38 taskkill.exe 1 30->38         started        signatures12 process13 process14 40 conhost.exe 38->40         started       
Score:
74%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/412fe46d202ca9907bc167cf3f8ef7ee558e49af623c3b0a681f8efe56537bdc
Verdict:
Malware
YARA:
2 match(es)
Tags:
DeObfuscated PowerShell T1027 T1059.001
Link:
https://app.malva.re/file/80cf319d056dbe030409cb0194f704e8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/412fe46d202ca9907bc167cf3f8ef7ee558e49af623c3b0a681f8efe56537bdc/
Threat name:
Script-JS.Trojan.Cryxos
Create hunting rule
Status:
Malicious
First seen:
2026-11-04 10:52:36 UTC
File Type:
Text (JavaScript)
AV detection:
10 of 38 (26.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iex6i3jafsuza66bm7ht7dxx5zky4snpmi6dwctid6hp4vstppoa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/261104-myldnsby3l/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
Adds Run key to start application
Checks computer location settings
Creates a file in the Startup directory
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/412fe46d202ca9907bc167cf3f8ef7ee558e49af623c3b0a681f8efe56537bdc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_Script_PowerShell_Hidden_Launcher
Create hunting rule
Author:Marjoriefort
Description:Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar
Reference:Veille fraicheur 2026-09-14 / cluster misses web

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments