MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c32379e4567a926aa0d35d8123718e2ebeb15544a83a5b1da0269db5829d5ece. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 8 File information Comments 2

SHA256 hash:	c32379e4567a926aa0d35d8123718e2ebeb15544a83a5b1da0269db5829d5ece
SHA3-384 hash:	5e89e374670e6315b3cd39984eb3eefe7d8ce3f0497f40752513fd122f3c25f980491be5d941fb8212272c9281095371
SHA1 hash:	389af5ce305d106cdb945fd3c33188ec2ae59805
MD5 hash:	71afc032342b400a00704cccc57815d4
humanhash:	oven-high-skylark-carolina
File name:	stage2.dec.js
Download:	download sample
File size:	115'332 bytes
First seen:	2025-12-01 08:33:11 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	1536:q/7W6FtMZCqh6bBoN7Ua+P0ZzB3vOUrzZLT0rWLaPI+7zfbioataI0ca3siJ46jN:m9O3GUv1LosIca3sQ4A
TLSH	T18AB33BCC6EA13361479773F1C4275E0F51BAE246980D8010EB3CD7C629ACA5AB5D7FA8
Magika	javascript
Reporter	marius_benthin
Tags:	glassworm js vscode

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.PUA.PowerShell.Agent-6.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=692d52ccc908fdc697474182

Tags:

n/a

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

base64 evasive lolbin masquerade obfuscated repaired schtasks

Link:

https://www.filescan.io/uploads/692d52cad0d5e7288b527e3d/reports/a3d96582-9a37-40a3-b2e2-f0b1bfa9dec6/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/c32379e4567a926aa0d35d8123718e2ebeb15544a83a5b1da0269db5829d5ece

Verdict:

Malicious

File Type:

First seen:

2025-12-02T19:25:00Z UTC

Last seen:

2025-12-02T19:43:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.Script.Agent.gen

Link:

https://opentip.kaspersky.com/c32379e4567a926aa0d35d8123718e2ebeb15544a83a5b1da0269db5829d5ece/results?tab=lookup

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/c32379e4567a926aa0d35d8123718e2ebeb15544a83a5b1da0269db5829d5ece

Verdict:

Malware

YARA:

2 match(es)

Tags:

Base64 Block Contains Base64 Block DeObfuscated PowerShell

Link:

https://app.malva.re/file/71afc032342b400a00704cccc57815d4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c32379e4567a926aa0d35d8123718e2ebeb15544a83a5b1da0269db5829d5ece/

Verdict:

Clean

Link:

https://tip.neiki.dev/file/c32379e4567a926aa0d35d8123718e2ebeb15544a83a5b1da0269db5829d5ece

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2025-12-01 08:34:19 UTC

File Type:

Text (JavaScript)

AV detection:

6 of 23 (26.09%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ymrxtzcwpkjgvigtlwasg4mof27lcvkeva5fwhnae2o3lau5l3ha._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/251201-kfzr8svpft/

Behaviour

Command and Scripting Interpreter: JavaScript

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.60

Link:

https://yomi.yoroi.company/submissions/c32379e4567a926aa0d35d8123718e2ebeb15544a83a5b1da0269db5829d5ece

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)