Local reference
Suspicious dependency
Inferred
Mal-ecule
O(Ca)H(U)
Objectives
notable severity, 90% confident.
credential-access/email/webmail
Reads DOM credential field values
component severity, 70% confident.
command-and-control/infrastructure
Username tracking field
component severity, 90% confident.
credential-access/phishing
Regex component marker
component severity, 75% confident.
lateral-movement/social-engineering
Inline password token in lure
component severity, 90% confident.
supply-chain/hidden-payload/extensions
innerHTML/location.href rewrite (page blocker shape)
component severity, 94% confident.
supply-chain/recon-exfil
Regex component marker
Micro-behaviors
notable severity, 82% confident.
ui/window/manage
Password input form field
baseline severity, 100% confident.
os/random/prng
Math.random invocation
component severity, 90% confident.
communications/http/url
Regex component marker
component severity, 82% confident.
crypto/symmetric/aes
JavaScript static key string assignment
component severity, 88% confident.
data/format
Hides element with display none
component severity, 88% confident.
data/text/keywords
Codebase deletion target
component severity, 100% confident.
fs/write
ADODB.Stream Open method call
component severity, 80% confident.
process/create/load
DOM script element literal
component severity, 86% confident.
process/create/shell
Git reset argument literal
Metadata
component severity, 97% confident.
file/text
Validation vocabulary array
component severity, 100% confident.
lang
Plain JavaScript identifier assignment
Identity
| SHA-256 | fa66ea0d5d2699d34a3beeaeae1b8a6ec2141a4ab8a28889d0eef407d1a997c4 |
|---|---|
| Filename | fa66ea0d5d2699d34a3beeaeae1b8a6ec2141a4ab8a28889d0eef407d1a997c4.unknown |
Origin
| Source | harvest |
|---|
Timeline
| First seen | 31 May 2026 22:55 UTC |
|---|---|
| First analyzed | 1 Jun 2026 07:24 UTC |
| Last analyzed | 1 Jun 2026 07:24 UTC |
| Last updated | 1 Jun 2026 07:24 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 961ce |
Not seeing what you expected? Let us know