MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60ec19fab5eee309069c92c8bb0b31fee178b056d367476c73e5deb38e17a72b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60ec19fab5eee309069c92c8bb0b31fee178b056d367476c73e5deb38e17a72b
SHA3-384 hash: 3573ad6bfd296b0cad1270789fec6aca481ddc7689f8125a636041a4e7e439920572bc4d2c3c664975d405861e7a230e
SHA1 hash: d5ed4ca73c044512aa3c8a7349ce6f11b7d81201
MD5 hash: 0275af680544de962bd9085be3a5b565
humanhash: thirteen-salami-timing-video
File name:RFQ-2026-00806_Supply.js
Download: download sample
File size:1'059'889 bytes
First seen:2026-08-06 08:35:32 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 6144:z/3KQUUcBEneCb8fpTCuHYVVgIqqh91vXYbdUF4lwEB/:bKZCrw/
TLSH T1C035EACFA3710D1C648A7A0FC8386E8E7A57CF930510BCBABDA45947D50C64253B9B6B
Magika javascript
Reporter abuse_ch
Tags:js

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.JS.DownLoader.10718.1219.32468.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.DownLoader.10718.12691.10315.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd conhost lolbin powershell repaired
Link:
https://www.filescan.io/uploads/6a74479b0d63bec568de64f7/reports/535e50c4-6640-4b93-8eed-0b38384af404/overview
Verdict:
Suspicious
Labled as:
JS/Agent.EVA
Link:
https://www.hybrid-analysis.com/sample/60ec19fab5eee309069c92c8bb0b31fee178b056d367476c73e5deb38e17a72b
Verdict:
Malicious
File Type:
text
First seen:
2026-08-05T21:08:00Z UTC
Last seen:
2026-08-08T06:12:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/60ec19fab5eee309069c92c8bb0b31fee178b056d367476c73e5deb38e17a72b/results?tab=lookup
Result
Threat name:
MicroClip
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1953191
Signature
Creates an undocumented autostart registry key
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: WScript or CScript Dropper
Suspicious command line found
Suspicious execution chain found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Yara detected MicroClip
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1953191 Sample: RFQ-2026-00806_Supply.js Startdate: 06/08/2026 Architecture: WINDOWS Score: 100 27 www.knockknock.top 2->27 35 Malicious sample detected (through community Yara rule) 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 Yara detected MicroClip 2->39 41 2 other signatures 2->41 10 wscript.exe 1 1 2->10         started        signatures3 process4 signatures5 47 JScript performs obfuscated calls to suspicious functions 10->47 49 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->49 51 Suspicious execution chain found 10->51 53 WScript reads language and country specific registry keys (likely country aware script) 10->53 13 conhost.exe 10->13         started        process6 signatures7 55 Suspicious command line found 13->55 16 conhost.exe 13->16         started        process8 signatures9 33 Suspicious command line found 16->33 19 cmd.exe 1 16->19         started        process10 process11 21 powershell.exe 15 21 19->21         started        25 cmd.exe 1 19->25         started        dnsIp12 29 209.54.103.173, 49753, 49754, 49755 AS-COLOCROSSING-HostPapaUS United States 21->29 31 www.knockknock.top 8.140.226.130, 49751, 80 ALIBABA-CN-NETHangzhouAlibabaAdvertisingCoLtdCN China 21->31 43 Creates an undocumented autostart registry key 21->43 45 Found many strings related to Crypto-Wallets (likely being stolen) 21->45 signatures13
Score:
86%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/60ec19fab5eee309069c92c8bb0b31fee178b056d367476c73e5deb38e17a72b
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60ec19fab5eee309069c92c8bb0b31fee178b056d367476c73e5deb38e17a72b/
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-06 00:33:27 UTC
File Type:
Text (JavaScript)
AV detection:
7 of 37 (18.92%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mdwbt6vv53rqsbu4slelwczr73qxrmcw2ntuo3dt4xplhdqxu4vq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
collection execution persistence
Link:
https://tria.ge/reports/260806-khzj9agl4y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Executes a command shell one-liner
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Checks computer location settings
Registers new Windows logon scripts automatically executed at logon.
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/60ec19fab5eee309069c92c8bb0b31fee178b056d367476c73e5deb38e17a72b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments