MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4dfdc3874ca9025f34c5890e2389aa66cf0e9da59690fb3ebcafc042bb2643de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4dfdc3874ca9025f34c5890e2389aa66cf0e9da59690fb3ebcafc042bb2643de
SHA3-384 hash:	6a6f3c1d052c919123e921be17e491c95eea53f7cf6a1d047fc74b7434e99249699049339cc2f7c86099980296501983
SHA1 hash:	1c2fb4259607d7d146226bf77ceb0fb2f8b9aa81
MD5 hash:	9e7028a94c2f4e1e07d74fe8a7f66e00
humanhash:	four-bacon-edward-monkey
File name:	0x29357B37392BA9A6
Download:	download sample
File size:	108'003'328 bytes
First seen:	2026-11-12 12:21:40 UTC
Last seen:	Never
File type:	js
MIME type:	application/javascript
ssdeep	3072:PGEbUxkTw0+6i8ylD8c33AVKq16aq1hvqRQpxfk3K2llU45o5r1VZui90a5llgEn:56iCbG8ulX
TLSH	T15738AA20A5594E3CF0A70D38C8A9560706AE25E6F3399DCC22871D571F93329A4E7FE7
Magika	javascript
Reporter	ni_fi_701
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

9

Origin country :

AT

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af5b2eeed14d027dfb56556

Tags:

proxy java

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4dfdc3874ca9025f34c5890e2389aa66cf0e9da59690fb3ebcafc042bb2643de

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4dfdc3874ca9025f34c5890e2389aa66cf0e9da59690fb3ebcafc042bb2643de

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jx64hb2mvebf6ngfrehchcnkm3hq5hnfs2ipwpv4v7aefozgippa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261112-prwbeagv21/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Reads the TCP/IP host and domain name from the registry

.NET Reactor proctector

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://pub-0bec69f492554744a0832f57d2301bfd.r2.dev/vtyukl.jpg

VirusSign cryxos

Malware Family:

cryxos

Alert

Create hunting rule

Malicious:

True

Tags:

javascript

Link:

https://intel.virussign.com/intelligence/file/4dfdc3874ca9025f34c5890e2389aa66cf0e9da59690fb3ebcafc042bb2643de

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.