Open-source atomic malware analysis

Analyze another

validator.js

JAVASCRIPT
Verdict: HOSTILE
SHA256: 0da934b7471a87a326f9afa9ea39c56ce03675947b55f031fb6367946a8236dd
Mal-ecule
KO₅(As₉ErPC₃S₅)H₂(OsPo)Md₂(Pa₂)
Size 11.9 KB download
First seen 118 days ago
Analyzed 110 days ago
Ecosystem malcontent-samples

Well-known

hostile severity, 100% confident.
malware/dropper xmrdropper hardcoded credentials and infra

Objectives

hostile severity, 95% confident.
anti-static/obfuscation/tools Obfuscated eval in JS bundle
hostile severity, 97% confident.
evasion/masquerade .js file masquerading as bash script
hostile severity, 96% confident.
persistence/system/service Obfuscated systemd persistence bash builder
suspicious severity, 87% confident.
anti-static/obfuscation/encoding Hexadecimal control flow obfuscation
suspicious severity, 85% confident.
anti-static/obfuscation/string String array with hex indexing
suspicious severity, 92% confident.
command-and-control/dropper/execution Obfuscated require decoder calls
notable severity, 85% confident.
anti-static/obfuscation High ratio of digit characters (junk padding)
notable severity, 100% confident.
supply-chain/hidden-payload File copy operations
baseline severity, 85% confident.
anti-static/obfuscation/code-metrics High function density
component severity, 100% confident.
command-and-control access() call
component severity, 80% confident.
command-and-control/channel/http URL path fragment 'unte' (part of /counter/)
component severity, 70% confident.
supply-chain/install-hook Top-level try/catch empty handler
component severity, 97% confident.
supply-chain/trojanized Empty catch hides loader errors
component severity, 100% confident.
supply-chain/trojanized/library require os

Micro-behaviors

baseline severity, 90% confident.
communications/http HTTPS protocol prefix
component severity, 88% confident.
process/create/shell Indirect WScript.Shell Run invocation

Metadata

suspicious severity, 100% confident.
file-extension-mismatch Shebang claims Shell but file is JavaScript (extension juke)
baseline severity, 100% confident.
lang/encoded JavaScript file basename
component severity, 90% confident.
package Very long line

Identity

SHA-256 0da934b7471a87a326f9afa9ea39c56ce03675947b55f031fb6367946a8236dd
Filename validator.js

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 3 May 2026 01:33 UTC
Last updated 3 May 2026 01:33 UTC

Labeling

Label bad
Label source harvest
Traits version b2c18