🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4
SHA3-384 hash: 6a8d9f875af9c96b61c37c499afe3e3e3c9c080f2c1f22fb9962597415c6aeaccc8f210bc8de7fca6543a532cda075ce
SHA1 hash: e34a48a74095e9f922b6b99de317150229e1ca45
MD5 hash: ec5dfee13abf94e08d0f94e90b527db0
humanhash: cola-uniform-zebra-lake
File name:75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.js
Download: download sample
File size:368'814 bytes
First seen:2026-05-21 08:55:40 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 3072:HkfJVLGWV7uG+e3m5Y+Xs1XZWN8vRbPoE74VPrPzILBZiTfsCZlMu+l5:oJVL/ui3m9XspoE7krPzI4c
Threatray 44 similar samples on MalwareBazaar
TLSH T10374838620C4DC6783E2277085AF96C9773E40D39427A1DEF249C3407596A6CB7BDCDA
Magika javascript
Reporter JAMESWT_WT
Tags:js web-telegram-ug

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0ec89d4f2b29ce040283a7
Tags:
infosteal emotet
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto dropper encrypted evasive fingerprint installer installer-heuristic lolbin obfuscated packed reconnaissance repaired wiper wscript
Link:
https://www.filescan.io/uploads/6a0ec8bfefbd399b39c1ceea/reports/032bac8f-1e71-4b6d-9b14-0558496ed6b7/overview
Verdict:
Malicious
Labled as:
HEUR_TrojanDownloader_Script_Generic
Link:
https://www.hybrid-analysis.com/sample/75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4
Verdict:
Malicious
File Type:
js
First seen:
2026-05-18T16:15:00Z UTC
Last seen:
2026-05-22T17:47:00Z UTC
Hits:
~100
Detections:
Trojan-Dropper.Win32.Injector.sb Trojan-Dropper.Win32.Injector.vhxm Trojan-Downloader.JS.SLoad.sb HEUR:Trojan.Script.Generic HEUR:Trojan-Dropper.Script.Generic PDM:Trojan.Win32.Generic Trojan-Dropper.JS.SDrop.sb Trojan-Downloader.JS.Cryptoload.sb HEUR:Trojan.Script.Alien.gen HEUR:Trojan-Downloader.Script.Generic
Link:
https://opentip.kaspersky.com/75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4/results?tab=lookup
Score:
2%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4
Verdict:
inconclusive
YARA:
1 match(es)
Link:
https://app.malva.re/file/ec5dfee13abf94e08d0f94e90b527db0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4/
Verdict:
Malicious
Threat:
Trojan-Dropper.Win32.Injector
Link:
https://tip.neiki.dev/file/75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-05-18 06:06:46 UTC
File Type:
Text (JavaScript)
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oxmauz7f7vzyhz6223xtxowpvvq7x443c3wnajxa322buwzcnd2a._file
Verdict:
suspicious
Label(s):
shellcode_loader_008
Create hunting rule
Similar samples:
105a60bceb01b8575009bc941a2c719187d63c689203105e55c50f0d101ef4a9
25d18a2bf31ff3ce40f2d042cbba8dc5a6cd4f680adcacc763c62d2e64168729
61c8de3128ca4893324f3327d8ca941e089dcc42eb0d2e6ef98616f5402234d5
8bee9ab21d010322b9274774d17d9a03ffeea4a66b9e69b60ce06d70e3211123
9d3f0f826f3c154499bba1c241ea658ce3d3639489cb19b79eb4534e9402f6f0
b03f5eba41b74cef1ac2926d4ac13c0b7b36e3df414796b11920bb89a077de77
e1f179df4b7c946e7161d61da71c136c2ddd203434f6cd926556894b48c712ea
e2cb2273a55009c6e7a42992f11a20a20f8c4efb645fc00f3bf5d05a1b0eceda
error
+ 34 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution installer persistence
Link:
https://tria.ge/reports/260521-kvvf3abz3t/
Behaviour
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Downloads MZ/PE file
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/75d80a67e5fd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments