MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e3b7e91cfd74e8c92b717a46ea27d3c0fdccc75be62bb5c2d8bc58c8acdd9bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6e3b7e91cfd74e8c92b717a46ea27d3c0fdccc75be62bb5c2d8bc58c8acdd9bf
SHA3-384 hash:	583b138699613e2940f1ed27ceaa0831c51747c8595e68e7b3c60c7944183c6881ad8ed3a15e65a3a74d37b846db6cca
SHA1 hash:	96e82bc45ad10459a23f757ab37f61ad7d46fc6e
MD5 hash:	65fe903c840f01d555ca08e1b8c8c54b
humanhash:	hydrogen-bulldog-fruit-solar
File name:	INVOICE $ PL 00987463536252-12062025.js
Download:	download sample
Signature	VIPKeylogger Alert Create hunting rule
File size:	15'045 bytes
First seen:	2025-06-13 06:21:36 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:hOfq8yBYzYyEyB58K/MMnKWlxmpoO+W1SKtxOi:hOCpWzYoPS0pP4xxOi
Threatray	3'492 similar samples on MalwareBazaar
TLSH	T1EB6252549445C6636D3383A1BB2EB425F79A4003B279E0A0F4DE9B052F75AE1A077FCB
Magika	javascript
Reporter	abuse_ch
Tags:	js VIPKeylogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

346

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.11663.12067.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=684bc54e07b5e8c1cfe6a51d

Tags:

obfuscate xtreme shell

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/6e3b7e91cfd74e8c92b717a46ea27d3c0fdccc75be62bb5c2d8bc58c8acdd9bf

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1713866

Signature

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Creates autostart registry keys with suspicious values (likely registry only malware)

Found suspicious powershell code related to unpacking or dynamic code loading

Found Tor onion address

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample has a suspicious name (potential lure to open the executable)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines

Sigma detected: Net WebClient Casing Anomalies

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Reflective Assembly Load

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

7%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/6e3b7e91cfd74e8c92b717a46ea27d3c0fdccc75be62bb5c2d8bc58c8acdd9bf

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6e3b7e91cfd74e8c92b717a46ea27d3c0fdccc75be62bb5c2d8bc58c8acdd9bf/

ReversingLabs TitaniumCloud Script-JS.Downloader.Remcos

Threat name:

Script-JS.Downloader.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-13 06:23:39 UTC

File Type:

Text (JavaScript)

AV detection:

9 of 38 (23.68%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ny5x5eop25hizevxc6sg5it5hqh5ztdvxzrlwxbnrpcyzcwn3g7q._file

Threatray vipkeylogger

Verdict:

malicious

Label(s):

vipkeylogger

Alert

Create hunting rule

Similar samples:

0a36f604c1dfb7297c21f2b74600caa5df81ae43c9c1824e4a8de425b0dfaede

VIPKeylogger

376d3dfd6f2d205e6a48bbeb3984d4b5f383d08c7cc71bd3d5487a633a13a0a5

VIPKeylogger

4af47504549fa0d35684bafb8276f3c8b0ae8a795b7026d53920e9505f1533b6

VIPKeylogger

b4a06f1be6894b9d689ca9a76ec35bde31c5fcd61311955dc3b286575d832dbb

VIPKeylogger

error

VIPKeylogger

+ 3'482 additional samples on MalwareBazaar

Hatching Triage vipkeylogger

Result

Malware family:

vipkeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vipkeylogger collection discovery execution keylogger persistence stealer

Link:

https://tria.ge/reports/250613-g6pheaan9t/

Behaviour

Modifies registry class

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

VIPKeylogger

Vipkeylogger family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.88

Link:

https://yomi.yoroi.company/submissions/6e3b7e91cfd74e8c92b717a46ea27d3c0fdccc75be62bb5c2d8bc58c8acdd9bf