MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe
SHA3-384 hash:	db70d3eb955c78ad293b069239109f09884ff67cf0842b9a8f814a6e45c674410d4dbc555d3dfd7ac2b488779c2f6a87
SHA1 hash:	1e787ae4c593cb20864dab2aec242b12c2b3bb52
MD5 hash:	6cf0d2d0df8483c81b8ab00e10127398
humanhash:	oxygen-gee-nitrogen-batman
File name:	Vymoga_VR_Registry_Audit_Forma_3_Signed_17_07_2026.js
Download:	download sample
File size:	2'744 bytes
First seen:	2026-07-17 16:39:32 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	48:WnVpb2KIyxMckbLwzkbjexXyscBPS+iw9BnJYjQmA0o9zWv7vHE8PWPQD:WVd2wepbLwAb6t03XJY0pP9zc7vHE83D
TLSH	T158516AE2F39567F453C511B7C00B390BA0EA9F761D1D916CFA21BCA3B43A33580A6744
Magika	javascript
Reporter	NoNameABC
Tags:	javascript js Loader malspam payload Ukraine

NoNameABC

Phishing campaign targeting Ukrainian businesses. Lure: Verkhovna Rada of Ukraine (Financial Audit).

1. DELIVERY VECTOR:
Emails sent from "postmaster@flfvrrordx.org"[cite: 1, 2] (Header From: "reply@helpdev.help"[cite: 1, 2]). The email contains a link to download a malicious ZIP archive (e.g., Vymoga_VR_Registry_Audit_Forma_3_Signed_17_07_2026.zip).
Observed download URLs:
- Direct link: hxxp://helpdev[.]help/uploadgov.php?...[cite: 1, 2]
- Redirect link: hxxps://limewire[.]com/d/xdPxn#QgFU7lxGto [The file has already been deleted]

2. EXECUTION CHAIN:
The ZIP contains a JS loader. It is executed via wscript.exe (LotL technique) and downloads intermediate Stage-2 PE payloads from C2: 31.76.252.31 (Hosted on VPSPay Networks AS 201988).

3. PERSISTENCE & POLYMORPHISM (CRITICAL NOTE):
The intermediate payloads drop a final persistence executable into the Startup directory (often named "getconfigurator.exe"). IMPORTANT: These final stage payloads exhibit polymorphic behavior — their hashes change per execution/victim.

4. VISUAL ANALYSIS:
- Phishing Lure Screenshot: https://ibb.co/PzP4y8ms
- Attack Graph & Execution Flow: https://ibb.co/XZz1VmvT

Intelligence

File Origin

# of uploads :

# of downloads :

185

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.PUA.IA.Suspicious.42461193.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5a5b1256bd89099b558fdf

Tags:

n/a

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive obfuscated repaired

Link:

https://www.filescan.io/uploads/6a5a5b0d5ecfc532dc125b1b/reports/d05431af-6505-42d4-a74b-a14609a9f518/overview

Verdict:

Malicious

Labled as:

SVM:TrojanDownloader/JS.MalBehav.gen

Link:

https://www.hybrid-analysis.com/sample/fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe

Verdict:

Malicious

File Type:

First seen:

2026-07-17T15:18:00Z UTC

Last seen:

2026-07-19T02:35:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe/results?tab=lookup

Score:

88%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7oksxi6rbjcnhrks2gapvn3jwdtcftaehjmvnjfvtzyaugfbat7a._file

Result

Malware family:

n/a

Score:

8/10

Tags:

execution

Link:

https://tria.ge/reports/260717-t6wypsfx5q/

Behaviour

Command and Scripting Interpreter: JavaScript

Badlisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.99

Link:

https://yomi.yoroi.company/submissions/fb952ba3d10a44d3c552d180fab769b0e622cc043a5956a4b59e700a18a104fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)