MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 685ff5b6823563b8d3c39080c1f18a8ec1888947abce3662341e82c000cd0469. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MintLoader


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 685ff5b6823563b8d3c39080c1f18a8ec1888947abce3662341e82c000cd0469
SHA3-384 hash: 2e151fb4d2b182e9198049e81dc1bfd9fd7323ab7c1b0f33df4180832043ec02f090b283fb9dba3adceb59c824dbd9b4
SHA1 hash: 968020fb1e31931dddfe88972391897cbbc2f9f5
MD5 hash: 2e49fb0f864cb318a46e80c1eddca8e6
humanhash: blue-don-queen-six
File name:window-sticker.js
Download: download sample
Signature MintLoader
Create hunting rule
File size:172'072 bytes
First seen:2026-02-04 11:57:24 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 3072:NP5olJ5o7YZ9jD2GSI8IHmKoy+iD2GSI8s:o
TLSH T1E8F39621A3FD4109FAF73F84ADB462655E36BCA6AD79D2AC1261004E4AB1F40DCB1737
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika vba
Reporter smica83
Tags:js MintLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=698334599a60ec70d92cbc69
Tags:
phishing shell agent sage
Verdict:
Suspicious
Labled as:
JS/Agent.DLY
Link:
https://www.hybrid-analysis.com/sample/685ff5b6823563b8d3c39080c1f18a8ec1888947abce3662341e82c000cd0469
Result
Gathering data
Verdict:
Malicious
File Type:
js
Link:
https://opentip.kaspersky.com/685ff5b6823563b8d3c39080c1f18a8ec1888947abce3662341e82c000cd0469/results?tab=lookup
Result
Threat name:
Mint Loader
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1863224
Signature
Creates processes via WMI
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Obfuscated command line found
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected Mint Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1863224 Sample: window-sticker.js Startdate: 04/02/2026 Architecture: WINDOWS Score: 100 33 hdywvr2.top 2->33 35 gsukn891nd0316f.top 2->35 37 cy6efdujkrg47hq.top 2->37 47 Suricata IDS alerts for network traffic 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 Yara detected Mint Loader 2->51 53 3 other signatures 2->53 10 wscript.exe 1 2->10         started        13 svchost.exe 1 1 2->13         started        signatures3 process4 dnsIp5 61 Obfuscated command line found 10->61 63 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->63 65 Suspicious execution chain found 10->65 67 Creates processes via WMI 10->67 16 conhost.exe 10->16         started        43 127.0.0.1 unknown unknown 13->43 signatures6 process7 signatures8 45 Obfuscated command line found 16->45 19 powershell.exe 14 24 16->19         started        process9 dnsIp10 39 hdywvr2.top 64.190.113.16, 49681, 80 TRAVELCLICKCORP1US United States 19->39 41 gsukn891nd0316f.top 45.61.136.195, 49690, 80 AS40676US United States 19->41 29 C:\Users\user\AppData\...\ony1xzct.cmdline, Unicode 19->29 dropped 55 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->55 57 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 19->57 59 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 19->59 24 csc.exe 3 19->24         started        file11 signatures12 process13 file14 31 C:\Users\user\AppData\Local\...\ony1xzct.dll, PE32 24->31 dropped 27 cvtres.exe 1 24->27         started        process15
Score:
74%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/685ff5b6823563b8d3c39080c1f18a8ec1888947abce3662341e82c000cd0469
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/685ff5b6823563b8d3c39080c1f18a8ec1888947abce3662341e82c000cd0469/
Verdict:
Malicious
Threat:
Trojan.JS.SAgent
Link:
https://tip.neiki.dev/file/685ff5b6823563b8d3c39080c1f18a8ec1888947abce3662341e82c000cd0469
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nbp7lnucgvr3ru6dscamd4mkr3ayrckhvphdmyrud2bmaagnaruq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution
Link:
https://tria.ge/reports/260204-n49h5ahv4c/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Badlisted process makes network request
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments