MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48e4e03a764edf04b50e01ffae551cc0b1bb07a6116d82851d3d76769b00d4be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	48e4e03a764edf04b50e01ffae551cc0b1bb07a6116d82851d3d76769b00d4be
SHA3-384 hash:	d1ebed0db03ac8fc77b33b89bd56a9bc5f819c851b9be6fa97d45137e169e551edacb048c80cc579e81833239c62df58
SHA1 hash:	cbcb7d3849349de0f8d87f1f3d38814cd2ba4d4e
MD5 hash:	481d833f5b9f4b8e0c477d2ab5b65014
humanhash:	muppet-illinois-spaghetti-speaker
File name:	KKAMobf1g5oQXJmd.js
Download:	download sample
File size:	375'276 bytes
First seen:	2026-03-31 10:53:09 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:tQ93T4hAGOt5vsErQkGm8B4fBCtw0GSHYsjKj5eucZ/h7dSWepe8HJ5INKJJ10Wn:e93T4hKPv3skNBCgSHYzbcngWepe8HJX
TLSH	T1E7845A0393FA4618F1F34B98AA7A10614E77BEA92D39C05D1699140E1BF3E149CB97F3
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	James_inthe_box
Tags:	exe js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

111

Origin country :

US

Vendor Threat Intelligence

ACCE

Gathering data

ClamAV Detected

Detection(s):

Sanesecurity.Rogue.0hr.20260330-1236.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69ca6a9d3a18a6e1ddefc2a8

Tags:

stration shell virus

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/69cba79be2df9aa488bfb364/reports/964e5cd4-1b5c-4448-9ee8-0b2b75f8902b/overview

Hybrid Analysis Trojan.JS.Agent.JS

Verdict:

Malicious

Labled as:

Trojan.JS.Agent.JS

Link:

https://www.hybrid-analysis.com/sample/48e4e03a764edf04b50e01ffae551cc0b1bb07a6116d82851d3d76769b00d4be

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-03-30T06:52:00Z UTC

Last seen:

2026-04-02T09:02:00Z UTC

Hits:

~1000

Detections:

PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/48e4e03a764edf04b50e01ffae551cc0b1bb07a6116d82851d3d76769b00d4be/results?tab=lookup

Nucleon Malprob Susipicious

Score:

57%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/48e4e03a764edf04b50e01ffae551cc0b1bb07a6116d82851d3d76769b00d4be

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Link:

https://app.malva.re/file/481d833f5b9f4b8e0c477d2ab5b65014

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/48e4e03a764edf04b50e01ffae551cc0b1bb07a6116d82851d3d76769b00d4be/

ReversingLabs TitaniumCloud Script.Trojan.Heuristic

Threat name:

Script.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-30 09:58:39 UTC

File Type:

Text (JavaScript)

AV detection:

8 of 24 (33.33%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jdsoaotwj3pqjnioah724vi4ycy3wb5gcfwyfbi5hv3hngya2s7a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution persistence

Link:

https://tria.ge/reports/260331-my3b7act6x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/48e4e03a764edf04b50e01ffae551cc0b1bb07a6116d82851d3d76769b00d4be