MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe66493e1ad2c9826f8379bc6c720ba24ce0c0dfb9a765faec79e335ea7a3b8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe66493e1ad2c9826f8379bc6c720ba24ce0c0dfb9a765faec79e335ea7a3b8f
SHA3-384 hash: ab0658d752ccf5b41359dd01ed3881e774f9990c9773192982ff059a80eb297967f986502bfd1d6b5cd6e9356a2e8147
SHA1 hash: 9c61f782063c36686d22fedb296f93784434518a
MD5 hash: e5ed46156a51862e9111a732d5a42947
humanhash: juliet-north-delta-island
File name:script4-from-2nd-obf-script.js
Download: download sample
File size:23'131 bytes
First seen:2026-06-26 10:38:49 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 384:fPbbGCoFTRB1Oohfuck4Lu6CdoBuwzs2IBAnXpl:GCoF1BUoUck4tbz
TLSH T148A2FE8EAE9175B66537F33CC72F8508FA65152301849A523E9CE092AF3186483F5FF9
Magika javascript
Reporter marsomx
Tags:Crafted8088 js node-js

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a3e56e286bc95245bf99f12
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
repaired
Link:
https://www.filescan.io/uploads/6a3e56de380cdec00af3b58d/reports/1790b647-6c66-4944-aa3c-590510e7ce0a/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/fe66493e1ad2c9826f8379bc6c720ba24ce0c0dfb9a765faec79e335ea7a3b8f
Verdict:
Malicious
File Type:
js
First seen:
2026-06-26T09:42:00Z UTC
Last seen:
2026-06-26T18:37:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.Script.Agent.gen
Link:
https://opentip.kaspersky.com/fe66493e1ad2c9826f8379bc6c720ba24ce0c0dfb9a765faec79e335ea7a3b8f/results?tab=lookup
Score:
7%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/fe66493e1ad2c9826f8379bc6c720ba24ce0c0dfb9a765faec79e335ea7a3b8f
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fe66493e1ad2c9826f8379bc6c720ba24ce0c0dfb9a765faec79e335ea7a3b8f/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/fe66493e1ad2c9826f8379bc6c720ba24ce0c0dfb9a765faec79e335ea7a3b8f
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ztespq22leye34dpg6gy4qlujgobqg7xgtwl6xmphrtl2t2hohq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
adware execution persistence ransomware spyware
Link:
https://tria.ge/reports/260626-mp6y1saw4w/
Behaviour
Checks SCSI registry key(s)
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Command and Scripting Interpreter: JavaScript
Enumerates connected drives
Boot or Logon Autostart Execution: Active Setup
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fe66493e1ad2c9826f8379bc6c720ba24ce0c0dfb9a765faec79e335ea7a3b8f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Author:ditekSHen
Description:Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://x.com/marsomx_/status/2070409152040403227

Comments