MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b56bc4a2f963eba3c75416404b684cd99cc1d27309fa5b6a5a709c73fbeb4fd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b56bc4a2f963eba3c75416404b684cd99cc1d27309fa5b6a5a709c73fbeb4fd5
SHA3-384 hash:	8e88c16adc38a66b5f62a65657cd0f388dfb7a2ae24346b9d9a7a364d3b712952b33f2959f4a4166ad75b62f3e9a063e
SHA1 hash:	33d45d550844adbd722d5aca58fce1db5151aac1
MD5 hash:	c3d3e85c060f70edc6e05be165bbb9da
humanhash:	jig-kitten-emma-freddie
File name:	Pago.js
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	1'689'185 bytes
First seen:	2026-07-17 12:34:16 UTC
Last seen:	2026-07-20 07:34:46 UTC
File type:	js
MIME type:	text/plain
ssdeep	96:1VQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQVQY:9rVbj8UUXG
TLSH	T1B4751BFB997619D0C76CBA7188188842F3F0107388E65E15B8F5ED80D6A64DAD486FFC
Magika	javascript
Reporter	James_inthe_box
Tags:	exe js PureLogsStealer

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

166

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.DownLoader.10514.11995.15023.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5a2166b3055706bb558a25

Tags:

stration shell spawn

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm fingerprint powershell repaired

Link:

https://www.filescan.io/uploads/6a5a21550ad33a99e5993992/reports/322271e2-6935-4619-985e-0c666b6d0986/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/b56bc4a2f963eba3c75416404b684cd99cc1d27309fa5b6a5a709c73fbeb4fd5

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-16T16:12:00Z UTC

Last seen:

2026-07-19T08:44:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/b56bc4a2f963eba3c75416404b684cd99cc1d27309fa5b6a5a709c73fbeb4fd5/results?tab=lookup

Nucleon Malprob Benign

Score:

7%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/b56bc4a2f963eba3c75416404b684cd99cc1d27309fa5b6a5a709c73fbeb4fd5

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Link:

https://app.malva.re/file/c3d3e85c060f70edc6e05be165bbb9da

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b56bc4a2f963eba3c75416404b684cd99cc1d27309fa5b6a5a709c73fbeb4fd5/

ReversingLabs TitaniumCloud Script-JS.Trojan.Malgent

Threat name:

Script-JS.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-17 00:54:18 UTC

File Type:

Binary

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wvv4jixzmpv2hr2uczaew2cm3gomduttbh5fw2s2ocohh67lj7kq._file

Threatray XWorm

Verdict:

malicious

Label(s):

XWorm

Alert

Create hunting rule

Link:

https://reports.threatray.com/10dce5a6-2dba-4d56-9e20-93408143b10e

Similar samples:

1b4a9f2ef2c2d24a36a720931c6b6ab75de02a0680ce73e0cd80971ddd11afe1

PureLogsStealer

3a444e7690f35fee4be070d0656bc7f0adab9bdcec798d5af27fc3c93e08f611

PureLogsStealer

3b39da6b761aebfac6324138212fd5a6eeb89a50ef1e7b8f8a813c07ac920062

PureLogsStealer

67e7b0bf057c8c7ef117be16a168833235920d0af16921ff59d0866f0d05e050

PureLogsStealer

d4a68d8a848dd0af45a07168ddb2cae1598d3dff26c7e1a82d55881af058c43b

PureLogsStealer

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution persistence rat trojan

Link:

https://tria.ge/reports/260717-pr24ysfs9z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Badlisted process makes network request

Detect Xworm Payload

Family: Xworm

Process spawned unexpected child process

Malware Config

C2 Extraction:

64.89.162.178:7007

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/b56bc4a2f963eba3c75416404b684cd99cc1d27309fa5b6a5a709c73fbeb4fd5