MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb51a8cff5b401653c7b0ee7cd3be33f8f5a6a7f9d9c9fe8f52c57f6edb4eaa6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bb51a8cff5b401653c7b0ee7cd3be33f8f5a6a7f9d9c9fe8f52c57f6edb4eaa6
SHA3-384 hash:	5c7523695ea79ba1415eb847c1e578fd980ae5cad6618c0b1e84ae37c0d1f0649ce6dc1c951950b5b6866de9f250c0d3
SHA1 hash:	d5cc1fdc41b344118fd2896fc4624166f1759b5c
MD5 hash:	62f8fa82a04e7da264f11c22ba077083
humanhash:	oscar-mars-queen-july
File name:	rccc123890.js
Download:	download sample
File size:	434'954 bytes
First seen:	2026-09-22 06:42:53 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:TTowOhYZHmf/1GcW9ZAGusQo9pXm+AMko5oyXXLWOQvecsmTG3NSGtvyRT6XGgHU:q
TLSH	T19D942C1277FA0A08F2B29F496A3B44650E7B7D55AC3CE21C169CA01D8BF3A44C865F77
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	lowmal3
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

141

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Muldrop.1417.1409.3413.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

downloader repaired sload

Link:

https://www.filescan.io/uploads/6ab2237f6aafcfb11a18ceeb/reports/84eb6d46-e345-4b20-9056-b0071e5a3512/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/bb51a8cff5b401653c7b0ee7cd3be33f8f5a6a7f9d9c9fe8f52c57f6edb4eaa6

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-09-16T08:15:00Z UTC

Last seen:

2026-09-24T02:59:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/bb51a8cff5b401653c7b0ee7cd3be33f8f5a6a7f9d9c9fe8f52c57f6edb4eaa6/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1975980

Signature

Multi AV Scanner detection for submitted file

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

94%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bb51a8cff5b401653c7b0ee7cd3be33f8f5a6a7f9d9c9fe8f52c57f6edb4eaa6

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bb51a8cff5b401653c7b0ee7cd3be33f8f5a6a7f9d9c9fe8f52c57f6edb4eaa6/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-16 12:30:44 UTC

File Type:

Text (JavaScript)

AV detection:

10 of 38 (26.32%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xni2rt7vwqawkpd3b3t42o7dh6hvu2t7twoj72hvfrl7n3nu5kta._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260922-hg11ksac73/

Behaviour

Script User-Agent

Command and Scripting Interpreter: JavaScript

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/bb51a8cff5b401653c7b0ee7cd3be33f8f5a6a7f9d9c9fe8f52c57f6edb4eaa6