MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b26fb4df0dced5245969f72924d7aa27de5e9c7c526365fd0545dca7bd79e5fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b26fb4df0dced5245969f72924d7aa27de5e9c7c526365fd0545dca7bd79e5fa
SHA3-384 hash:	b301646a643f88011cbbb4177a2b5832ae851069c559ac32717b6ca9a8785b0d6d9b36da97ba11869a1f03b159fcf71c
SHA1 hash:	9da279b4fd55277b4bd2e81f34515717643c7d00
MD5 hash:	40ac4f5981a284239f2ebea2ed2584c1
humanhash:	mars-mockingbird-sixteen-timing
File name:	ePRzHXrdth.js
Download:	download sample
Signature	Vjw0rm Alert Create hunting rule
File size:	12'117 bytes
First seen:	2026-06-22 05:01:15 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:cbx96AfiuTeweFAJOFskwf94RCA2C73d5Yvq4i6vLdI9lUcOOIGr1EhUu:W9625TeweFAJ5kwf+0S73dbRn9RIGrmB
TLSH	T13842A5784C07E314C795E7C06E0B8A9A7E6E97635366604FB548E1C03BB0C98E15DBF8
Magika	javascript
Reporter	BastianHein
Tags:	js vjw0rm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

156

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Cryxos-Q.35776892.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a38c1bf1548daf709f89ed5

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm evasive fingerprint lolbin obfuscated persistence reconnaissance repaired vbc

Link:

https://www.filescan.io/uploads/6a38c1ba62d0679105faeecd/reports/fb7e7567-d7c7-47bd-8c95-00d99449ae3c/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/b26fb4df0dced5245969f72924d7aa27de5e9c7c526365fd0545dca7bd79e5fa

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-22T02:08:00Z UTC

Last seen:

2026-06-22T04:36:00Z UTC

Hits:

~10

Detections:

HEUR:Worm.Script.Generic HEUR:Trojan.Script.Startup.gen HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.SLoad.gen Trojan.Script.vjWorm.a Trojan.JS.SAgent.sb Trojan-Downloader.JS.SLoad.sb PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/b26fb4df0dced5245969f72924d7aa27de5e9c7c526365fd0545dca7bd79e5fa/results?tab=lookup

Nucleon Malprob Malware

Score:

89%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b26fb4df0dced5245969f72924d7aa27de5e9c7c526365fd0545dca7bd79e5fa

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b26fb4df0dced5245969f72924d7aa27de5e9c7c526365fd0545dca7bd79e5fa/

Neiki Family.VJW0RM

Verdict:

Malicious

Threat:

Family.VJW0RM

Link:

https://tip.neiki.dev/file/b26fb4df0dced5245969f72924d7aa27de5e9c7c526365fd0545dca7bd79e5fa

ReversingLabs TitaniumCloud Script-JS.Trojan.Cryxos

Threat name:

Script-JS.Trojan.Cryxos

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-22 05:01:53 UTC

File Type:

Text (JavaScript)

AV detection:

15 of 36 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wjx3jxynz3ksiwlj64usjv5ke7pf5hd4kjrwl7ifixokpplz4x5a._file

Hatching Triage vjw0rm

Result

Malware family:

vjw0rm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vjw0rm execution trojan worm

Link:

https://tria.ge/reports/260622-fnyspagz8m/

Behaviour

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Drops startup file

Family: Vjw0rm

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b26fb4df0dced5245969f72924d7aa27de5e9c7c526365fd0545dca7bd79e5fa