MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acd61a16ce92fa9c8cc8296f7918b9db794ae0df7f9ef3c803450e396eeb1cc1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: acd61a16ce92fa9c8cc8296f7918b9db794ae0df7f9ef3c803450e396eeb1cc1
SHA3-384 hash: 2dc959bacaec7ac29525566f5984f2ee1110eec98b8a6299e756b4d1c89a9f00cd3f52048b5f3c9d73877b849b20c0ec
SHA1 hash: 06ec04ecba5a4b3826c05bf68dfc086b5267d7ff
MD5 hash: 4510268acb6e52e4cf036ae90caf9066
humanhash: four-alabama-summer-cold
File name:acd61a16ce92fa9c8cc8296f7918b9db794ae0df7f9ef3c803450e396eeb1cc1.js
Download: download sample
File size:2'628'131 bytes
First seen:2026-07-02 16:21:33 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 384:SnmFu3Sc4B/n8YogfT+6n3nXn2sta0nXCn9nTnWnwQ/haJXnXnWLnxSSnBXNW4Jl:eK
TLSH T15CC508BF9E518968D4704669DCD50FD99691D835048AF89E3F7F81F0BA30A662C38CF2
Magika javascript
Reporter JAMESWT_WT
Tags:38-224-110-3 js

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.VBS.Obfus-174.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a469049949bf83c342baba5
Tags:
cryxos virus shell spawn
Verdict:
Malicious
Labled as:
Trojan.JS.Agent.JS
Link:
https://www.hybrid-analysis.com/sample/acd61a16ce92fa9c8cc8296f7918b9db794ae0df7f9ef3c803450e396eeb1cc1
Verdict:
Malicious
File Type:
js
First seen:
2026-06-06T00:13:00Z UTC
Last seen:
2026-07-03T05:48:00Z UTC
Hits:
~10
Detections:
Trojan.VBS.SAgent.sb Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic
Link:
https://opentip.kaspersky.com/acd61a16ce92fa9c8cc8296f7918b9db794ae0df7f9ef3c803450e396eeb1cc1/results?tab=lookup
Score:
37%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/acd61a16ce92fa9c8cc8296f7918b9db794ae0df7f9ef3c803450e396eeb1cc1
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/acd61a16ce92fa9c8cc8296f7918b9db794ae0df7f9ef3c803450e396eeb1cc1/
Verdict:
Malicious
Threat:
Trojan.VBS.SAgent
Link:
https://tip.neiki.dev/file/acd61a16ce92fa9c8cc8296f7918b9db794ae0df7f9ef3c803450e396eeb1cc1
Threat name:
Script-JS.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-06-05 09:32:31 UTC
File Type:
Binary
AV detection:
9 of 36 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vtlbufwosl5jzdgiffxxsgfz3n4uvyg7p6pphsadiuhds3xldtaq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution
Link:
https://tria.ge/reports/260702-tvfscahw6y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: JavaScript
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/acd61a16ce92fa9c8cc8296f7918b9db794ae0df7f9ef3c803450e396eeb1cc1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments