MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b6b53ffc24cf8ca9350321c1b073a7ff034eca45020453af607be0d455d47dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9b6b53ffc24cf8ca9350321c1b073a7ff034eca45020453af607be0d455d47dd
SHA3-384 hash:	8e02564e16733ebbf1457df0944604c9436bd85612a1bc26de894c39624caefc16e009456520b7c740e605c7400f0fe5
SHA1 hash:	4861a526791e589ddb231e063acf16bbc8c972ee
MD5 hash:	0b1060c30c723304f664e1c305cbebcd
humanhash:	timing-purple-march-saturn
File name:	Down_Payment.js
Download:	download sample
File size:	978'722 bytes
First seen:	2026-05-11 09:21:36 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12288:Us78y7MtTv3meeUFQgJ2sVJG6MYU0Dgv1oBh1:M5jwy
Threatray	2 similar samples on MalwareBazaar
TLSH	T15A25723DCAE5011EF4B29A10BDB8041FE4767B56262DC94F11D1154F4E32A0DBBAEB2E
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	lowmal3
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

134

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a01de3c059cfdadce20d854

Tags:

infosteal rapid

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

conhost encrypted evasive masquerade powershell repaired

Link:

https://www.filescan.io/uploads/6a019fda2fcb905ec28d1a90/reports/2b0ebed4-68f1-44af-adbd-d848800ba0bf/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/9b6b53ffc24cf8ca9350321c1b073a7ff034eca45020453af607be0d455d47dd

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-05-11T05:43:00Z UTC

Last seen:

2026-05-13T07:34:00Z UTC

Hits:

~1000

Detections:

PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/9b6b53ffc24cf8ca9350321c1b073a7ff034eca45020453af607be0d455d47dd/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1911501

Signature

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Powershell scriptblock execution from environment variable

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

48%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/9b6b53ffc24cf8ca9350321c1b073a7ff034eca45020453af607be0d455d47dd

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Link:

https://app.malva.re/file/0b1060c30c723304f664e1c305cbebcd

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9b6b53ffc24cf8ca9350321c1b073a7ff034eca45020453af607be0d455d47dd/

Neiki Trojan.Win32

Verdict:

Malicious

Threat:

Trojan.Win32

Link:

https://tip.neiki.dev/file/9b6b53ffc24cf8ca9350321c1b073a7ff034eca45020453af607be0d455d47dd

ReversingLabs TitaniumCloud Win32.Trojan.Ravartar

Threat name:

Win32.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-11 08:46:51 UTC

File Type:

Text (JavaScript)

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tnvvh76cjt4mve2qgiobwbz2p7ydj3fekaqekoxwa67a2rk5i7oq._file

Threatray stubrunner purecrypter

Verdict:

malicious

Label(s):

stubrunner

Alert

Create hunting rule

purecrypter

Alert

Create hunting rule

Similar samples:

2003bb24fba6a50570bf6cbdecc84549a9cf47849ffcd5250a8b5390751c5707

error

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection discovery execution persistence

Link:

https://tria.ge/reports/260511-lbnd3shv2q/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Time Discovery

Drops file in Windows directory

Accesses Microsoft Outlook profiles

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/9b6b53ffc24cf8ca9350321c1b073a7ff034eca45020453af607be0d455d47dd