MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 416242568b18fd669338b6da2f8d3e084160bf6b2b91ac12ef3f3e8434b69e53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DeerStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 6 File information Comments

SHA256 hash:	416242568b18fd669338b6da2f8d3e084160bf6b2b91ac12ef3f3e8434b69e53
SHA3-384 hash:	b8b21c1f0781bc8e7f8b55543bfeefc1c2d2264330a773d3f0752a90061d2f88fdf55190f47fb731025a799a42fc27ae
SHA1 hash:	d16bb17741a8de4734ff28e5ebffddbb0614b592
MD5 hash:	84cadd2a2f609334d7fb930ccc46ee4b
humanhash:	enemy-georgia-washington-charlie
File name:	main.js
Download:	download sample
Signature	DeerStealer Create hunting rule
File size:	555'334 bytes
First seen:	2026-10-12 15:32:31 UTC
Last seen:	Never
File type:	js
MIME type:	application/javascript
ssdeep	6144:91mcT2ANdgG9L3+4IunbdXC0KaJxtf9nAzuNFjFK4uQacxSltKkbkk5MZZFBz/:32AgG5+4bFC0KaJxtf9nO4uExSk/
TLSH	T11DC4C7CE3BC6F05046867576256F2017B03ECCDA304D9598E3689CE9BC7570EA5BAE38
Magika	javascript
Reporter	Daydream
Tags:	backdoor ClickFix DeerStealer dga electron js

Daydream

resources/app/main.js from the trojanised GitHub Desktop 3.5.7-beta2 package github.zip (5ab3080efc9f1563677b49e1c36b1937a38e4bee2f1c259d8da79c0e06ab1045); the only altered file (dated 2026-09-30, the other 909 files 2026-03-12). 314,718 bytes are prepended to the genuine bundle: string array (base64, swapped case), a JavaScript bytecode VM, then a 2.3 KB plain implant at offset 312391. Implant (plain JavaScript after the VM): every 180 s POSTs JSON [id from %APPDATA%\daemons.log, COMPUTERNAME, USERNAME, optional readme.txt tokens] to https://<name>.com/nlu/ with certificate checks off; a reply task.e is passed to eval, task.files (base64) are written to %TEMP%\<ms timestamp>\ and the .exe is started. <name> comes from a VM-protected function IwD(): one .com name per 10-day window, date-only seed. Evaluated offline with a faked clock: 2026-09-24 edgnltatqptann, 10-04 aeyibtnr, 10-14 anwhinweudee, 10-24 ttasqdwmpwnaw, 11-03 dilruire, 11-13 tensoehhitrln, 11-23 eelifjdoeae, 12-03 hruieeoefeor, 12-13 ejtteyte, 12-23 tiumloir (each +.com). Follow-up payloads (HijackLoader, DeerStealer) are described in https://blakekwhite.com/research/clickfix-github-desktop-backdoor/ and were not retrieved by us.

Intelligence

File Origin

# of uploads :

# of downloads :

210

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad0fe6b6f551121ba161b94

Tags:

malware

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

base64 obfuscated repaired

Link:

https://www.filescan.io/uploads/6accfdba24e6633b77b0ca38/reports/9d9a6148-9256-476b-9013-d9975c79509f/overview

Verdict:

Malicious

Labled as:

JS_Agent_VLK_trojan

Link:

https://www.hybrid-analysis.com/sample/416242568b18fd669338b6da2f8d3e084160bf6b2b91ac12ef3f3e8434b69e53

Verdict:

Malicious

File Type:

First seen:

2026-10-02T03:58:00Z UTC

Last seen:

2026-10-12T23:37:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/416242568b18fd669338b6da2f8d3e084160bf6b2b91ac12ef3f3e8434b69e53/results?tab=lookup

Score:

26%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/416242568b18fd669338b6da2f8d3e084160bf6b2b91ac12ef3f3e8434b69e53

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/416242568b18fd669338b6da2f8d3e084160bf6b2b91ac12ef3f3e8434b69e53/

Threat name:

Script-JS.Trojan.Redirector

Status:

Malicious

First seen:

2026-10-01 12:52:02 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 23 (30.43%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ifreevuldd6wnezyw3nc7dj6bbawbp3lfoi2yexph47iinfwtzjq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/261012-szaapatv2q/

Behaviour

Command and Scripting Interpreter: JavaScript

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/416242568b18fd669338b6da2f8d3e084160bf6b2b91ac12ef3f3e8434b69e53

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	ldpreload Create hunting rule
Author:	xorseed
Reference:	https://stuff.rop.io/

Rule name:	SCRIPT_Dropper_Formbook_ForgeAuto_10592ed2_Script Create hunting rule
Author:	Marjoriefort
Description:	Detects Formbook (script_js, etat script)

Rule name:	SCRIPT_Dropper_Formbook_ForgeAuto_a070f81e_Script Create hunting rule
Author:	Marjoriefort
Description:	Detects Formbook (script_js, etat script)

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)