MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e36016bb9cd242865f3ccda92b764526f6c5a8ca1494dfbe98ecce35c8e181d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e36016bb9cd242865f3ccda92b764526f6c5a8ca1494dfbe98ecce35c8e181d2
SHA3-384 hash: 837a0357336ea23cd76f622af3149888f6a790c68d60c76e96d8626e552fb2cf0a811c65d338ed62ab15442b71572f5d
SHA1 hash: fd79e298a84e91815bff5ee56aae1a8c9a11682c
MD5 hash: 53852358bf0c0097021a185990825ac9
humanhash: one-echo-pizza-william
File name:PO 4500107199_2.js
Download: download sample
File size:9'721'545 bytes
First seen:2026-08-20 14:38:42 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 24576:gU4Y19laat47RP89QBGwusuBhmE6HYCY6GObo174UIREbax6ei3HToCLK5q12KPd:EUsWg7r4UsWg7rH
TLSH T105A6F9B376CE6691AA1D77A7C48C69198786C4218D93B5C490CF0E4E5C2F58F26E0FCE
Magika javascript
Reporter abuse_ch
Tags:js

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Labled as:
GT:JS.Acsogenixx.5964
Link:
https://www.hybrid-analysis.com/sample/e36016bb9cd242865f3ccda92b764526f6c5a8ca1494dfbe98ecce35c8e181d2
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1961258
Signature
Bypasses PowerShell execution policy
Creates autostart registry keys with suspicious values (likely registry only malware)
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
JavaScript file contains suspicious strings
JavaScript source code contains functionality to generate code involving a shell, file or stream
Multi AV Scanner detection for submitted file
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1961258 Sample: PO 4500107199_2.js Startdate: 20/08/2026 Architecture: WINDOWS Score: 100 67 www.google.com 2->67 69 mr-b01.tm-azurefd.net 2->69 71 3 other IPs or domains 2->71 79 Multi AV Scanner detection for submitted file 2->79 81 Yara detected Powershell decode and execute 2->81 83 JavaScript source code contains functionality to generate code involving a shell, file or stream 2->83 85 4 other signatures 2->85 9 wscript.exe 2 4 2->9         started        12 powershell.exe 17 2->12         started        14 powershell.exe 2->14         started        16 powershell.exe 2->16         started        signatures3 process4 signatures5 87 Suspicious powershell command line found 9->87 89 Wscript starts Powershell (via cmd or directly) 9->89 91 Creates autostart registry keys with suspicious values (likely registry only malware) 9->91 97 3 other signatures 9->97 18 powershell.exe 15 9->18         started        93 Writes to foreign memory regions 12->93 95 Injects a PE file into a foreign processes 12->95 21 aspnet_compiler.exe 1 12->21         started        23 aspnet_compiler.exe 12->23         started        25 aspnet_compiler.exe 12->25         started        27 conhost.exe 12->27         started        29 aspnet_compiler.exe 14->29         started        31 conhost.exe 14->31         started        33 WerFault.exe 2 14->33         started        35 conhost.exe 16->35         started        process6 signatures7 73 Writes to foreign memory regions 18->73 75 Found suspicious powershell code related to unpacking or dynamic code loading 18->75 77 Injects a PE file into a foreign processes 18->77 37 aspnet_compiler.exe 1 18->37         started        39 aspnet_compiler.exe 18->39         started        41 aspnet_compiler.exe 18->41         started        43 conhost.exe 18->43         started        45 WerFault.exe 21 21->45         started        47 conhost.exe 21->47         started        49 2 other processes 23->49 51 2 other processes 25->51 53 2 other processes 29->53 process8 process9 55 WerFault.exe 3 21 37->55         started        57 conhost.exe 37->57         started        59 conhost.exe 39->59         started        61 WerFault.exe 39->61         started        63 conhost.exe 41->63         started        65 WerFault.exe 41->65         started       
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e36016bb9cd242865f3ccda92b764526f6c5a8ca1494dfbe98ecce35c8e181d2
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e36016bb9cd242865f3ccda92b764526f6c5a8ca1494dfbe98ecce35c8e181d2/
Threat name:
Script-JS.Trojan.Acsogenixx
Create hunting rule
Status:
Malicious
First seen:
2026-08-20 12:58:21 UTC
File Type:
Text (JavaScript)
AV detection:
6 of 36 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4nqbno442jbimxz4zwusw5sfe33mlkgkcskn7puy5thdlshbqhja._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/260820-r1fnesdr4x/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
ConfuserEx .NET packer
Suspicious use of SetThreadContext
Adds Run key to start application
Creates a file in the Startup directory
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e36016bb9cd242865f3ccda92b764526f6c5a8ca1494dfbe98ecce35c8e181d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments