🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9bea5f89984d47dd60216b0a0b064e8c7e8057e0c10509faa4a2d8d641eb73b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PivotC2


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9bea5f89984d47dd60216b0a0b064e8c7e8057e0c10509faa4a2d8d641eb73b
SHA3-384 hash: b123bd97e49d5fc5fa776265a66d9061390dffee29d4ffa25f4c8ae929067fe67d456b3b94d07bd1d85c0071b285334b
SHA1 hash: 86887dc1952c24617c28ac30d55b6ac0f0c950df
MD5 hash: fd9970758e5a84d096ff0b978429b982
humanhash: zebra-video-may-queen
File name:live_146.103.99.177_9443_decoded.js
Download: download sample
Signature PivotC2
Create hunting rule
File size:35'686 bytes
First seen:2026-09-11 10:39:03 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 384:NhC4inUX7S6a3L5fxjYhanLcXLqMk/AJf3ft:NhC4inUXutZxU6ANft
TLSH T10EF2848ADDE620246533F2794B9F9005F27AE1070109CE54BE4CD2E0AF64BB855EDFE9
Magika javascript
Reporter SOCRadarSTRU
Tags:js PivotC2 STRU

Intelligence

File Origin
# of uploads :
1
# of downloads :
36
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
expand lolbin repaired
Link:
https://www.filescan.io/uploads/6aa3f273a4523f6792db4861/reports/f68aac0b-060c-4bf6-93c4-9a5a48e65267/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/a9bea5f89984d47dd60216b0a0b064e8c7e8057e0c10509faa4a2d8d641eb73b
Verdict:
Unknown
File Type:
js
Link:
https://opentip.kaspersky.com/a9bea5f89984d47dd60216b0a0b064e8c7e8057e0c10509faa4a2d8d641eb73b/results?tab=lookup
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/a9bea5f89984d47dd60216b0a0b064e8c7e8057e0c10509faa4a2d8d641eb73b
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9bea5f89984d47dd60216b0a0b064e8c7e8057e0c10509faa4a2d8d641eb73b/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vg7kl6ezqtkh3vqcc2ykbmde5dd6qbl6bqifbh5kjiwy2za6w45q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/260911-pjy3bsvzfy/
Behaviour
Command and Scripting Interpreter: JavaScript
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/a9bea5f89984d47dd60216b0a0b064e8c7e8057e0c10509faa4a2d8d641eb73b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:testlumma
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments