MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a6d7cbf4853d4e88b7dc42f7711d14d8df772db12f3932b9cd90ba3ec0a03af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8a6d7cbf4853d4e88b7dc42f7711d14d8df772db12f3932b9cd90ba3ec0a03af
SHA3-384 hash:	f19ac268d2f7ce1cd14fddbd6cadc9550bdc668c9592579959d248c0a1a65f1d32f74f1451cd3eb3daa114dd4bfd90e4
SHA1 hash:	2eebef2d354a670f4bf37b3198c023c8736082b5
MD5 hash:	8e49ddf12f3c5651c35b4a8e3a6d877b
humanhash:	alaska-uniform-mike-oregon
File name:	222921026033312.js
Download:	download sample
Signature	SiriusRAT Alert Create hunting rule
File size:	1'600'976 bytes
First seen:	2026-07-20 12:38:17 UTC
Last seen:	2026-07-20 17:52:08 UTC
File type:	js
MIME type:	text/plain
ssdeep	24576:xunyrBtQ1hcQmQC1MR0ZptspncIVJRG9CZz4f86t:xun0BtUBTM40Zjspnc8JRG9CZEfLt
TLSH	T1B5757E417DE160055AB5F95CBD6B21C902B23759BB3A876C1CCE97868BB7C0CC1FAB12
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	lowmal3
Tags:	js SiriusRAT

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

179

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5e16c9bcffb2c48cb7a1dd

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd conhost expand lolbin powershell repaired

Link:

https://www.filescan.io/uploads/6a5e16c3a42ac81879614e27/reports/b30cdab2-7a0d-4a6d-8084-04e41e6087b6/overview

Hybrid Analysis VBS/Obfuscated.G trojan

Verdict:

Suspicious

Labled as:

VBS/Obfuscated.G trojan

Link:

https://www.hybrid-analysis.com/sample/8a6d7cbf4853d4e88b7dc42f7711d14d8df772db12f3932b9cd90ba3ec0a03af

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-20T08:51:00Z UTC

Last seen:

2026-07-21T10:46:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/8a6d7cbf4853d4e88b7dc42f7711d14d8df772db12f3932b9cd90ba3ec0a03af/results?tab=lookup

Joe Sandbox RDPWrap Tool, Clipboard Hijacker, Sirius

Result

Threat name:

RDPWrap Tool, Clipboard Hijacker, Sirius

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.spre.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1945192

Signature

Contains functionality to hide user accounts

Contains functionality to start a terminal service

Creates an undocumented autostart registry key

Deletes shadow drive data (may be related to ransomware)

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious command line found

Suspicious execution chain found

Tries to access browser extension known for cryptocurrency wallets

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected Clipboard Hijacker

Yara detected Generic Stealer

Yara detected RDPWrap Tool

Yara detected Sirius Rat

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/8a6d7cbf4853d4e88b7dc42f7711d14d8df772db12f3932b9cd90ba3ec0a03af

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8a6d7cbf4853d4e88b7dc42f7711d14d8df772db12f3932b9cd90ba3ec0a03af/

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-20 12:39:32 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 38 (18.42%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rjwxzp2ikpkorc35yqxxoeorjwg7o4w3clzzgk443ef2h3akaoxq._file

Hatching Triage siriusrat

Result

Malware family:

siriusrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:siriusrat execution persistence rat

Link:

https://tria.ge/reports/260720-pt9xkscw6x/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

Looks up external IP address via web service

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Detects SiriusRAT

Family: SiriusRAT

Malware Config

C2 Extraction:

133.18.107.191:4449

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8a6d7cbf4853d4e88b7dc42f7711d14d8df772db12f3932b9cd90ba3ec0a03af