🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7170ebfd9a113da292b5877de77ce0f0ac217866355b994d52685f18e0c5305. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7170ebfd9a113da292b5877de77ce0f0ac217866355b994d52685f18e0c5305
SHA3-384 hash: b8d2e442a23f286c64e6298a0b3ef3215e05f9e304a93c456497344760c479a41647c125bf949426aaab9619fe165344
SHA1 hash: 0b44b2e224d1b70bc4b2fb7a78feaea4319153ac
MD5 hash: 65c9855dfcd2b6f69eb5ad3ec4ded899
humanhash: virginia-finch-fanta-georgia
File name:listed_Desc_&_Qty Details.js
Download: download sample
File size:36'980 bytes
First seen:2026-01-26 18:44:17 UTC
Last seen:2026-02-09 14:19:01 UTC
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 192:W/ofXggLs/ofXggLeB2dtcXUFC+afPearWtN74mUUCNJkb88DnmXZiVVzrk3b3Js:o2wXd+afPRU74mUUx0ZrZs
Threatray 3 similar samples on MalwareBazaar
TLSH T145F2BB12768F960860B3568C9A9F12B40B9F7A9F0E7E418900CDE68B8FD3515DC5B3B7
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika vba
Reporter Anonymous
Tags:DesckVB-RAT js

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.26866.JsHeur.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.JS.Exec-1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69779db36fa3eed1652f31e1
Tags:
xtreme shell sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 powershell powershell repaired
Link:
https://www.filescan.io/uploads/6977b610a57b6af70d0d7738/reports/bdba2334-080e-4e36-97c8-1f425abc2877/overview
Verdict:
Malicious
Labled as:
PowerShell/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/e7170ebfd9a113da292b5877de77ce0f0ac217866355b994d52685f18e0c5305
Verdict:
Malicious
File Type:
js
First seen:
2026-01-26T11:20:00Z UTC
Last seen:
2026-01-27T03:26:00Z UTC
Hits:
~100
Detections:
PDM:Trojan.Win32.Generic Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic Trojan-Downloader.VBS.Agent.bra
Link:
https://opentip.kaspersky.com/e7170ebfd9a113da292b5877de77ce0f0ac217866355b994d52685f18e0c5305/results?tab=lookup
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e7170ebfd9a113da292b5877de77ce0f0ac217866355b994d52685f18e0c5305
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7170ebfd9a113da292b5877de77ce0f0ac217866355b994d52685f18e0c5305/
Verdict:
Malicious
Threat:
Trojan.JS.SAgent
Link:
https://tip.neiki.dev/file/e7170ebfd9a113da292b5877de77ce0f0ac217866355b994d52685f18e0c5305
Threat name:
Script-JS.Backdoor.njRAT
Create hunting rule
Status:
Malicious
First seen:
2026-01-26 17:15:49 UTC
File Type:
Text (JavaScript)
AV detection:
8 of 38 (21.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=44lq5p6zuej5ukjllb35456ob4fmef4gmnk3tfgve2c7ddqmkmcq._file
Verdict:
malicious
Label(s):
unc_loader_078
Create hunting rule
njrat
Create hunting rule
Similar samples:
008902cb35391208a2c1ceecf2c10afdf17f938c9b4cae1a92843e9875cc1a1c
49867e00912b7c6e886c4ad99c07fcef8063f6a9c51b618b52df592512ab9a2a
ed35a441716fbb903e2140e2cbebf5f266462fd23c11c5d6ba199298218d0ed0
error
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery execution persistence privilege_escalation
Link:
https://tria.ge/reports/260126-xdqg1ae18h/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Indicator Removal: File Deletion
.NET Reactor proctector
Checks computer location settings
Badlisted process makes network request
Modifies Windows Firewall
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e7170ebfd9a113da292b5877de77ce0f0ac217866355b994d52685f18e0c5305

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments