MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82d75976bb4947e9da7e3e8f4bbeefa33cf4ed2eceba40a255875e74c82e81b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	82d75976bb4947e9da7e3e8f4bbeefa33cf4ed2eceba40a255875e74c82e81b8
SHA3-384 hash:	c62579f88d1e871b8aa1dfe46c530c717216575ca3c3fc0522dd7490610e3f114050591b640cc454761029110b0ef9be
SHA1 hash:	c000a30cfb256cb2a273cef22bc2002974e287e4
MD5 hash:	2b7482504147976501675f330dbce29d
humanhash:	chicken-paris-nitrogen-coffee
File name:	Auto-Resolutorio.js
Download:	download sample
File size:	352'874 bytes
First seen:	2026-08-25 21:24:01 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:HjYuPMbdKcsBu1ZQPUtLT13fPB5DlQcsLtlHVthbJCOjcn6blBXHAUFGrkVL:rEpsBuvoWP70ttsn6J9AUFVVL
TLSH	T19D74BFEE6A49DD381F8C72CD8F03685E3D6EB7C1185EB1CCA1C42127535A51BEAE0D29
Magika	javascript
Reporter	cypherpunk472
Tags:	colombia js lure

cypherpunk472

https://ik.imagekit.io/uf6w2lmjp8/Auto-Resolutorio.zip password 6024

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

107

Origin country :

CO

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd evasive lolbin obfuscated powershell repaired

Link:

https://www.filescan.io/uploads/6a8e07ff15a86fc45cd682ab/reports/bdfede49-08e4-4600-9f54-1c1d537ba856/overview

Hybrid Analysis JS/Agent.EWV

Verdict:

Suspicious

Labled as:

JS/Agent.EWV

Link:

https://www.hybrid-analysis.com/sample/82d75976bb4947e9da7e3e8f4bbeefa33cf4ed2eceba40a255875e74c82e81b8

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-25T14:20:00Z UTC

Last seen:

2026-08-25T17:38:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/82d75976bb4947e9da7e3e8f4bbeefa33cf4ed2eceba40a255875e74c82e81b8/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/82d75976bb4947e9da7e3e8f4bbeefa33cf4ed2eceba40a255875e74c82e81b8

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Link:

https://app.malva.re/file/2b7482504147976501675f330dbce29d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/82d75976bb4947e9da7e3e8f4bbeefa33cf4ed2eceba40a255875e74c82e81b8/

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qllvs5v3jfd6twt6h2huxpxpum6pj3joz25ebisvq5phjsboqg4a._file

Hatching Triage asyncrat

Result

Malware family:

asyncrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat botnet:cal035 defense_evasion discovery execution persistence rat

Link:

https://tria.ge/reports/260825-z85lhsyhpa/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Hide Artifacts: Hidden Files and Directories

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Async RAT payload

Family: AsyncRat

Malware Config

C2 Extraction:

nuevaera2026202620262026.duckdns.org:7707
nuevaera2026202620262026.duckdns.org:3009

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.