Open-source atomic malware analysis

Analyze another

package/clob.js

UNKNOWN
Verdict: HOSTILE
SHA256: 954728b16738a4b44696a599eecde211ece2ccfcc9eb47bfaf4ba5c3ab6715be
Mal-ecule
O₇(C₄Dy₃Er₂EuSPXe₂)H₅(Cm₃DbF₃Os₂Po₃)Md(In)
Size 9.6 KB download
First seen 56 days ago
Analyzed 56 days ago
Ecosystem javascript

Found in 1 archive

Objectives

hostile severity, 96% confident.
command-and-control/dropper/execution Supply-chain dropper via destructured child_process
hostile severity, 96% confident.
command-and-control/infrastructure DNS resolution bypass for hardcoded fallback
suspicious severity, 95% confident.
command-and-control/dropper Extracts archive then executes contents
suspicious severity, 85% confident.
discovery/system/fingerprint User information collection
suspicious severity, 80% confident.
evasion/self-delete/file fs.unlink with empty callback
suspicious severity, 95% confident.
exfiltration Environment variable exfiltration (JS)
suspicious severity, 85% confident.
supply-chain/trojanized/app Network listener combined with data exfiltration
notable severity, 85% confident.
discovery/network/scan api.ipify.org IP lookup
notable severity, 85% confident.
execution/condition Executes different commands based on OS platform
notable severity, 85% confident.
execution/interpreter/vbscript WScript.Shell object creation

Micro-behaviors

notable severity, 85% confident.
communications/ip Hardcoded external IPv4 address
notable severity, 85% confident.
data/text ipify.org external IP lookup
notable severity, 100% confident.
fs/write Reference to .vbs file extension
notable severity, 80% confident.
fs/write/file Creates a write stream
notable severity, 80% confident.
os/com WScript.Shell object string
notable severity, 80% confident.
os/wsh Instantiates WScript.Shell object
notable severity, 90% confident.
process/create Detached ignored unref spawn
notable severity, 100% confident.
process/create/shell Executes shell commands synchronously
notable severity, 80% confident.
process/user os.userInfo() user query

Metadata

notable severity, 80% confident.
import require('child_process') import

20 of 64 traits shown

Identity

SHA-256 954728b16738a4b44696a599eecde211ece2ccfcc9eb47bfaf4ba5c3ab6715be
Filename package/clob.js

Origin

Source harvest
Feed osv.dev
Ecosystem javascript

Timeline

First seen 25 May 2026 21:11 UTC
First analyzed 25 May 2026 21:11 UTC
Last analyzed 25 May 2026 21:11 UTC
Last updated 25 May 2026 21:11 UTC

Labeling

Label bad
Label source harvest