Open-source atomic malware analysis

Analyze another

VirusShare_48d6ff6be693ce323f2d21a3c587dd76

JAVASCRIPT
Verdict: SUSPICIOUS
SHA256: c25df7bfaa6db8102a468af829cf4706acff0db4aa8de1bb50a03bac5bc98e81
Mal-ecule
O(C)H₂(OsU)
Size 50.0 KB download
First seen 108 days ago
Analyzed 106 days ago

Well-known

component severity, 100% confident.
malware/stealer Regex component marker

Objectives

notable severity, 75% confident.
command-and-control/infrastructure/domain Blogspot URL reference
baseline severity, 70% confident.
anti-static/obfuscation/code-metrics Low identifier reuse ratio
component severity, 94% confident.
anti-static/obfuscation/payload Architecture keyed encoded blob value
component severity, 100% confident.
anti-static/obfuscation/string Known JavaScript library source
component severity, 94% confident.
command-and-control/dropper Regex component marker
component severity, 90% confident.
command-and-control/remote-command Regex component marker
component severity, 92% confident.
credential-access/cloud Regex component marker
component severity, 90% confident.
credential-access/email/webmail Regex component marker
component severity, 92% confident.
execution/interpreter/scripting "lica" fragment of split Shell.Application
component severity, 90% confident.
lateral-movement/brute-force Weak password master
component severity, 94% confident.
supply-chain/recon-exfil Regex component marker

Micro-behaviors

suspicious severity, 90% confident.
os/telemetry/logging Google Analytics tracking identifier
notable severity, 78% confident.
ui/window/manage References iframe DOM element
baseline severity, 90% confident.
communications/http HTTP protocol prefix
component severity, 100% confident.
process/create/shell Regex component marker

Metadata

baseline severity, 80% confident.
file/text Sequential source identifier names
baseline severity, 100% confident.
lang javascript code embedded in string
baseline severity, 98% confident.
library Google Tag Manager bundle
baseline severity, 100% confident.
package Code has TS type annotations (extra)

20 of 29 traits shown

Identity

SHA-256 c25df7bfaa6db8102a468af829cf4706acff0db4aa8de1bb50a03bac5bc98e81
Filename VirusShare_48d6ff6be693ce323f2d21a3c587dd76

Origin

Source harvest

Timeline

First seen 12 May 2026 19:13 UTC
First analyzed 15 May 2026 07:38 UTC
Last analyzed 15 May 2026 07:38 UTC
Last updated 15 May 2026 07:38 UTC

Labeling

Label bad
Label source harvest
Traits version 08128