MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89cb7df9fbc20fe3db2709295e0a9c78a64d690fb65058ef5e40218aba0a5818. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	89cb7df9fbc20fe3db2709295e0a9c78a64d690fb65058ef5e40218aba0a5818
SHA3-384 hash:	24b42b30c93087614efd768b5133f5486c81fa74f755172f1f8a06cd8e6646f1a0dc52a5dcf7a29d0c32eb78273c6683
SHA1 hash:	0bfc3292b5bc730871aa32e56677f3a5146cf2a0
MD5 hash:	ca50c98a451ba6c633b9d7e4aa5c8ea3
humanhash:	beer-juliet-tennis-finch
File name:	PO-02.js
Download:	download sample
File size:	971'033 bytes
First seen:	2026-08-18 19:08:43 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:y7ICTDvuSFXjrabHTUZWeEKWP2VkVaBO4ZjXvVXv0EVse4gsw7QPd5BkCU7EOJII:wIWcsfA+
TLSH	T1BD25CD322A4D92F89C6C0791C80E53EDFF68152CC21E6D0EBEF6B5E49636A941C32D75
Magika	javascript
Reporter	TomU
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

142

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.65483448.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

obfuscated repaired

Link:

https://www.filescan.io/uploads/6a84adf41691959ccc521a01/reports/c08e5a8c-022b-49c2-8c61-41c212d813ff/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/89cb7df9fbc20fe3db2709295e0a9c78a64d690fb65058ef5e40218aba0a5818

Nucleon Malprob Susipicious

Score:

36%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/89cb7df9fbc20fe3db2709295e0a9c78a64d690fb65058ef5e40218aba0a5818

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/89cb7df9fbc20fe3db2709295e0a9c78a64d690fb65058ef5e40218aba0a5818/

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-10 10:38:01 UTC

File Type:

Binary

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rhfx36p3yih6hwzhbeuv4cu4pcte22ipwzifr326iaqyvoqklama._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution persistence privilege_escalation

Link:

https://tria.ge/reports/260818-xt3ghagj61/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Creates a file in the Startup directory

Badlisted process makes network request

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://muddy-sound-e0cd.nodetectonn.workers.dev/TPhFU

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/89cb7df9fbc20fe3db2709295e0a9c78a64d690fb65058ef5e40218aba0a5818