MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 884f1552fe526d72f01035f8fd1b565d254b52fbbfcb6cb034f34598794f7d7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	884f1552fe526d72f01035f8fd1b565d254b52fbbfcb6cb034f34598794f7d7d
SHA3-384 hash:	a57ff292d971b1fdf1470cf88a16ba253ebaf991c79b8e59f2c2ea629850c3d947fd64fb4e4b48829f3282fc11aa82ca
SHA1 hash:	a5064f36a48ef1914c62879098bf9d49a58314c5
MD5 hash:	00ba06448d5e03dfbfa60a4bc2219193
humanhash:	diet-saturn-kansas-connecticut
File name:	asset.txt
Download:	download sample
Signature	SmartLoader Alert Create hunting rule
File size:	306'113 bytes
First seen:	2024-11-17 10:50:46 UTC
Last seen:	2025-03-24 10:55:18 UTC
File type:	js
MIME type:	text/plain
ssdeep	3072:kdh3S5Bw/cCnmToOU4A9MK1WJub4++YsoC4kQJ7jqejB2mzvuKwaSBR/CEuI3wX:kDCfw/cepjPu7Jub4LYsoLqFdKw3/gX
TLSH	T14F5482B6A04C04F059EF86A6DC6BBDAB91BAD5F94306664B0F2CF1A73520172C7D9C07
Magika	javascript
Reporter	aachum
Tags:	js SmartLoader

iamaachum

https://github.com/user-attachments/files/17562972/Program.zip

Must be loaded through a LuaJIT executable for the script to work.

SmartLoader C2: http://89.169.13.169/api/OWUsODEsN2QsYTAsYTMsOGEsOGMsOTUsNmIsODIs

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

85

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Unknown

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=673b033a80d21948b03249a6

Tags:

virus micro gates

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6739ca987c0503873505bfac/reports/e048c0a9-86d5-4842-ab2b-cbc899c5728a/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/884f1552fe526d72f01035f8fd1b565d254b52fbbfcb6cb034f34598794f7d7d

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1557472

Signature

Sigma detected: Cscript/Wscript Uncommon Script Extension Execution

Sigma detected: WScript or CScript Dropper

Uses an obfuscated file name to hide its real file extension (double extension)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

84%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/884f1552fe526d72f01035f8fd1b565d254b52fbbfcb6cb034f34598794f7d7d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/884f1552fe526d72f01035f8fd1b565d254b52fbbfcb6cb034f34598794f7d7d/

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2024-10-25 03:59:05 UTC

File Type:

Text (Lua)

AV detection:

3 of 38 (7.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rbhrkux6kjwxf4aqgx4p2g2wlusuwux3x7fwzmbu6nczq6kppv6q._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/884f1552fe526d72f01035f8fd1b565d254b52fbbfcb6cb034f34598794f7d7d

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SmartLoader

js 884f1552fe526d72f01035f8fd1b565d254b52fbbfcb6cb034f34598794f7d7d

(this sample)

any.run

https://app.any.run/tasks/6272f2f4-a179-4d18-9f71-84716f68830c

  

Delivery method

Distributed via web download