MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92bab327f0800fe67fdd049fc76f9acfcbd5c5b79794187192f48c6cae0e0724. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

KongTuke

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	92bab327f0800fe67fdd049fc76f9acfcbd5c5b79794187192f48c6cae0e0724
SHA3-384 hash:	d8653ee5104f046ef55c3ccc9549bddb8519dfaff66413a0a9dccc262bffbab182c10d784f272c8cc138953064273ebf
SHA1 hash:	9b0b4569d684f363eb38c574f380ce26f5c96e7d
MD5 hash:	26231c038d7733d7e2761215b81f38ad
humanhash:	charlie-shade-apart-angel
File name:	file.js
Download:	download sample
Signature	KongTuke Create hunting rule
File size:	8'789 bytes
First seen:	2026-07-09 22:35:00 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	96:uvRvYdlW8UVbbBiOVgQ5mTwPTEx/CQdBCpjMzrXrr8wgN+2kpxiTsFGSJDI7Y4rJ:U5Y3VUVbb8oRnPT2zB02frO+2kp7NI7f
TLSH	T15702C91B732512F7D5AA1CE70B1F01461075F12B2C01E0A2CAA1F9563DBDF8269767B8
Magika	javascript
Reporter	aachum
Tags:	ClickFix js Kongtuke

iamaachum

https://henreques.lol/file.js

Intelligence

File Origin

# of uploads :

# of downloads :

181

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a50223fa900f0e9eb6b6c75

Tags:

vmprotect dropper extens virus

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated repaired

Link:

https://www.filescan.io/uploads/6a50223988c01512d1d92b16/reports/6ae3e570-3aaf-4647-a597-bd42b40edd43/overview

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/92bab327f0800fe67fdd049fc76f9acfcbd5c5b79794187192f48c6cae0e0724

Verdict:

Clean

File Type:

Link:

https://opentip.kaspersky.com/92bab327f0800fe67fdd049fc76f9acfcbd5c5b79794187192f48c6cae0e0724/results?tab=lookup

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1940298

Signature

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Behaviour

Behavior Graph:

Download SVG

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/92bab327f0800fe67fdd049fc76f9acfcbd5c5b79794187192f48c6cae0e0724

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/92bab327f0800fe67fdd049fc76f9acfcbd5c5b79794187192f48c6cae0e0724/

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/92bab327f0800fe67fdd049fc76f9acfcbd5c5b79794187192f48c6cae0e0724

Threat name:

Script-JS.Trojan.Cryxos

Status:

Malicious

First seen:

2026-07-09 22:35:55 UTC

File Type:

Text (JavaScript)

AV detection:

6 of 38 (15.79%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sk5lgj7qqah6m765asp4o342z7f5lrnxs6kbq4ms6sggzlqoa4sa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260709-2hy26aat8l/

Behaviour

Command and Scripting Interpreter: JavaScript

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/92bab327f0800fe67fdd049fc76f9acfcbd5c5b79794187192f48c6cae0e0724

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)