MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41cbfd1a09f66f0b565f85e0912c15051c837283466da84890eb8a5c5b6c1771. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	41cbfd1a09f66f0b565f85e0912c15051c837283466da84890eb8a5c5b6c1771
SHA3-384 hash:	abb3576659ae48f3a6a7db0f7e18f38bf3fdbe0bd98928f33f56a7930b379b80dc0d977abdc91dd8a2379504c392c432
SHA1 hash:	7ba7da12c0287d5ddbc7773b75a3e5a46b32d6d0
MD5 hash:	7e2c9a7722d7940b3a91d7e9d843e8fd
humanhash:	winner-september-orange-yankee
File name:	k-2-1-68-Lancaster_segment.js
Download:	download sample
File size:	826'355 bytes
First seen:	2026-10-14 15:15:43 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:5eBcIFU6EjbzPUJK0nJ4ctXJWzt0KRl0lLJ4BggnJX54tKdW4zKzXzCzPUJK0nJj:4C6Ejb+9VnPALu
TLSH	T13C052F07990B6C985770AA1657D07307E950839FA062C307FBAE830C5BE5B6C57AEF87
Magika	txt
Reporter	TomU
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

84

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-201.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad149edf4e17c78f715f8f6

Tags:

obfuscate xtreme shell

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6acf9cc8d3bae837b81899a3/reports/b2ab9ff4-6b31-409d-b3c1-ab9e1b8cee49/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/41cbfd1a09f66f0b565f85e0912c15051c837283466da84890eb8a5c5b6c1771

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-09-03T05:39:00Z UTC

Last seen:

2026-10-14T07:03:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/41cbfd1a09f66f0b565f85e0912c15051c837283466da84890eb8a5c5b6c1771/results?tab=lookup

Nucleon Malprob Susipicious

Score:

62%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/41cbfd1a09f66f0b565f85e0912c15051c837283466da84890eb8a5c5b6c1771

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/41cbfd1a09f66f0b565f85e0912c15051c837283466da84890eb8a5c5b6c1771/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-03 13:27:00 UTC

File Type:

Text (JavaScript)

AV detection:

8 of 38 (21.05%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ihf72gqj6zxqwvs7qxqjclavauoig4udizw2qseq5offyw3mc5yq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261014-snnc6sw1fx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Reads the TCP/IP host and domain name from the registry

Command and Scripting Interpreter: PowerShell

Badlisted process makes network request

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://lively-fog-af49.pablosoftwareplus.workers.dev/reEzT

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/41cbfd1a09f6/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/41cbfd1a09f66f0b565f85e0912c15051c837283466da84890eb8a5c5b6c1771