MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a44cdc09efee4306bfd3e76dc65af3876965ffa9fff4a5f4b8c7b4c0fc867084. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a44cdc09efee4306bfd3e76dc65af3876965ffa9fff4a5f4b8c7b4c0fc867084
SHA3-384 hash:	7492c22f57fa1efdd15a2ade14c21d1061f4a3c2ed60bad26f66177f9031e9aa98e64d8cabb06c8f0328b63f3f02a2b2
SHA1 hash:	47d7d7731ec955f5dbe89b6740c064359f4829d4
MD5 hash:	ee6646fb7c11be161099a19a3fe6e2e1
humanhash:	lima-autumn-ack-maryland
File name:	ee6646fb7c11be161099a19a3fe6e2e1.js
Download:	download sample
Signature	PhantomStealer Alert Create hunting rule
File size:	18'325 bytes
First seen:	2026-02-27 17:13:17 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:KSPfNlzkG4pqF9dfHvrvnOe2MomTIwZ7jeNkz6u9D4B:KYfHsYOe1oC7jYSz4B
TLSH	T11C82038C3EC6F2A65271A437AD2FA15EF7FE5C90B58CC095C63D5CA2E814308E9B6C54
Magika	javascript
Reporter	abuse_ch
Tags:	js PhantomStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

93

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.59729228.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a1d0ebc950ab5d9ab22d6e

Tags:

ransomware downloader shell

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

evasive obfuscated repaired

Link:

https://www.filescan.io/uploads/69a1d0e997feb4afd65fcc1f/reports/def732a0-5820-40be-a28d-c79f5672518e/overview

Hybrid Analysis SVM:TrojanDownloader/JS.Nemucod

Verdict:

Malicious

Labled as:

SVM:TrojanDownloader/JS.Nemucod

Link:

https://www.hybrid-analysis.com/sample/a44cdc09efee4306bfd3e76dc65af3876965ffa9fff4a5f4b8c7b4c0fc867084

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Detections:

Trojan-Downloader.JS.SLoad.sb HEUR:Trojan-Downloader.Script.Generic HEUR:Trojan.Script.Generic Trojan-Downloader.Agent.HTTP.C&C

Link:

https://opentip.kaspersky.com/a44cdc09efee4306bfd3e76dc65af3876965ffa9fff4a5f4b8c7b4c0fc867084/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad.spyw.expl

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1876140

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

Browser instances using unsafe startup parameters

Bypasses PowerShell execution policy

Creates a thread in another existing process (thread injection)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Monitors registry run keys for changes

Multi AV Scanner detection for submitted file

Potential obfuscated javascript found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected Generic JS Downloader

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

94%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a44cdc09efee4306bfd3e76dc65af3876965ffa9fff4a5f4b8c7b4c0fc867084

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a44cdc09efee4306bfd3e76dc65af3876965ffa9fff4a5f4b8c7b4c0fc867084/

Neiki Family.PHANTOM

Verdict:

Malicious

Threat:

Family.PHANTOM

Link:

https://tip.neiki.dev/file/a44cdc09efee4306bfd3e76dc65af3876965ffa9fff4a5f4b8c7b4c0fc867084

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-27 03:12:03 UTC

File Type:

Text (JavaScript)

AV detection:

10 of 38 (26.32%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=urgnycpp5zbqnp6t45w4mwxtq5uwl75j772kl5fyy62mb7egocca._file

Threatray fantomcrypt

Verdict:

malicious

Label(s):

fantomcrypt

Alert

Create hunting rule

Similar samples:

error

PhantomStealer

Hatching Triage phantom_stealer

Result

Malware family:

phantom_stealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:phantom_stealer collection discovery execution persistence stealer

Link:

https://tria.ge/reports/260227-vrkgssaw3g/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

outlook_win_path

Checks processor information in registry

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Badlisted process makes network request

Detects PhantomStealer payload

PhantomStealer

Phantom_stealer family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a44cdc09efee4306bfd3e76dc65af3876965ffa9fff4a5f4b8c7b4c0fc867084