MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e499e99aa0c8e1eaf6363ccb77eef74dcaa21f2e8d29bfbfc6c67f8afaf63a58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e499e99aa0c8e1eaf6363ccb77eef74dcaa21f2e8d29bfbfc6c67f8afaf63a58
SHA3-384 hash:	f095eff8720abfae6de67526f529959c6ff2fa2f467f6d5104a2b6e2014aefadfd2cf3d56e19f6662bd333e3e54b22b8
SHA1 hash:	36594bd8ae8551853a4d5fbd2e559a49efaa6ed3
MD5 hash:	e2aa8a33fdafba149d63759fe8f5ed27
humanhash:	july-berlin-yellow-nine
File name:	stage4_linux-key-agent.js
Download:	download sample
File size:	32'040 bytes
First seen:	2026-10-21 18:04:57 UTC
Last seen:	Never
File type:	js
MIME type:	application/javascript
ssdeep	768:CJU6vnnFSpKy26yT+ZGpMbnCaQrCqxo64Cns//ZkFw0Ov/XdSx6vag2DiobFLs:DCnApKyC6Xgo64gs//ZktAKrDiobFLs
TLSH	T17BE285C8AFD9B13D138234772827905AE7A94CA63988F0F4E259394CBEB5359F137429
TrID	70.0% (.) Unix-like shebang (var.1) (gen) (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	javascript
Reporter	popkir
Tags:	ContagiousInterview DPRK EtherHiding fake-interview js

popkir

Stage 4 Linux keyboard/clipboard agent from http://80.190.73.17:5056/download-linux-key.

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

90

Origin country :

ES

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad8ff995a22ac805bd91cdd

Tags:

n/a

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e499e99aa0c8e1eaf6363ccb77eef74dcaa21f2e8d29bfbfc6c67f8afaf63a58

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

unix shell

Link:

https://opentip.kaspersky.com/e499e99aa0c8e1eaf6363ccb77eef74dcaa21f2e8d29bfbfc6c67f8afaf63a58/results?tab=lookup

Nucleon Malprob Susipicious

Score:

47%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/e499e99aa0c8e1eaf6363ccb77eef74dcaa21f2e8d29bfbfc6c67f8afaf63a58

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e499e99aa0c8e1eaf6363ccb77eef74dcaa21f2e8d29bfbfc6c67f8afaf63a58/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-21 18:08:24 UTC

File Type:

Text (JavaScript)

AV detection:

4 of 24 (16.67%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4sm6tgvazdq6v5rwhtfxp3xxjxfkehzoruu37p6gyz7yv6xwhjma._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  4/10

Tags:

antivm discovery linux

Link:

https://tria.ge/reports/261021-wqz2javsfy/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Checks CPU configuration

Reads CPU attributes

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e499e99aa0c8e1eaf6363ccb77eef74dcaa21f2e8d29bfbfc6c67f8afaf63a58