23271661200073b5ff798fe27725c10cf4b29080bc8b15def4bd02b5bce13a6a | Triage™

Login
Reports

Overview

overview

3

Static

static

1

stay-clean...ler.js

windows10-2004-x64

3

stay-clean...ler.js

windows11-ltsc_2024-x64

3

stay-clean...tp.ps1

windows10-2004-x64

3

stay-clean...tp.ps1

windows11-ltsc_2024-x64

3

stay-clean...g.html

windows10-2004-x64

3

stay-clean...g.html

windows11-ltsc_2024-x64

3

stay-clean...q.html

windows10-2004-x64

3

stay-clean...q.html

windows11-ltsc_2024-x64

3

stay-clean...ocs.sh

ubuntu-18.04-amd64

1

stay-clean...ocs.sh

debian-9-armhf

1

stay-clean...ocs.sh

debian-9-mips

1

stay-clean...ocs.sh

debian-9-mipsel

stay-clean...tor.js

windows10-2004-x64

3

stay-clean...tor.js

windows11-ltsc_2024-x64

3

stay-clean...s.html

windows10-2004-x64

3

stay-clean...s.html

windows11-ltsc_2024-x64

3

stay-clean...l.html

windows10-2004-x64

3

stay-clean...l.html

windows11-ltsc_2024-x64

3

stay-clean...x.html

windows10-2004-x64

3

stay-clean...x.html

windows11-ltsc_2024-x64

3

stay-clean...l.html

windows10-2004-x64

3

stay-clean...l.html

windows11-ltsc_2024-x64

3

stay-clean...Exp.js

windows10-2004-x64

3

stay-clean...Exp.js

windows11-ltsc_2024-x64

3

stay-clean...der.js

windows10-2004-x64

3

stay-clean...der.js

windows11-ltsc_2024-x64

3

stay-clean...Php.js

windows10-2004-x64

3

stay-clean...Php.js

windows11-ltsc_2024-x64

3

stay-clean...ore.js

windows10-2004-x64

3

stay-clean...ore.js

windows11-ltsc_2024-x64

3

stay-clean...acy.js

windows10-2004-x64

3

stay-clean...acy.js

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
stay-clean.zip
Size 1.8MB
Sample261023-pc3f6sss5p
SHA256 23271661200073b5ff798fe27725c10cf4b29080bc8b15def4bd02b5bce13a6a
MD5 4de5d2ed7d15fd2e24949cae4375d3f4
SHA1 af6e2b74ac6d31426ab974dee60e29947139a61c
SHA512 c3312b0999056e7dc2e7ccbf83f3b7c3babc8762d75c35a550bf3d7938d008f442c2545095b5d89b5406369a1789916ec6186a8fda39d6af583bcb47e4d34965
SSDEEP 49152:ixIsw9EafzIRK1bY6Co4H5X68cSSe82gSbT:i1qE0zIQdCo4HwwRPv
TLSH
T1289523F5E2434264C25AEAFC3E9C86276F7BF20058E07829559E1A7CCC894BD7613936
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution linux

Static task

static1

Behavioral task

behavioral1

Sample

stay-clean.org/PHPMailer/class.phpmailer.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral2

Sample

stay-clean.org/PHPMailer/class.phpmailer.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral3

Sample

stay-clean.org/PHPMailer/class.smtp.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

stay-clean.org/PHPMailer/class.smtp.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

stay-clean.org/PHPMailer/docs/extending.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral6

Sample

stay-clean.org/PHPMailer/docs/extending.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

Behavioral task

behavioral7

Sample

stay-clean.org/PHPMailer/docs/faq.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral8

Sample

stay-clean.org/PHPMailer/docs/faq.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

Behavioral task

behavioral9

Sample

stay-clean.org/PHPMailer/docs/generatedocs.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

stay-clean.org/PHPMailer/docs/generatedocs.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

stay-clean.org/PHPMailer/docs/generatedocs.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

stay-clean.org/PHPMailer/docs/generatedocs.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

stay-clean.org/PHPMailer/examples/code_generator.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

stay-clean.org/PHPMailer/examples/code_generator.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

stay-clean.org/PHPMailer/examples/contents.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral16

Sample

stay-clean.org/PHPMailer/examples/contents.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

Behavioral task

behavioral17

Sample

stay-clean.org/PHPMailer/examples/gmail.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral18

Sample

stay-clean.org/PHPMailer/examples/gmail.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

Behavioral task

behavioral19

Sample

stay-clean.org/PHPMailer/examples/index.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral20

Sample

stay-clean.org/PHPMailer/examples/index.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

Behavioral task

behavioral21

Sample

stay-clean.org/PHPMailer/examples/mail.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral22

Sample

stay-clean.org/PHPMailer/examples/mail.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

Behavioral task

behavioral23

Sample

stay-clean.org/PHPMailer/examples/scripts/XRegExp.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

stay-clean.org/PHPMailer/examples/scripts/XRegExp.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

stay-clean.org/PHPMailer/examples/scripts/shAutoloader.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

stay-clean.org/PHPMailer/examples/scripts/shAutoloader.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral27

Sample

stay-clean.org/PHPMailer/examples/scripts/shBrushPhp.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral28

Sample

stay-clean.org/PHPMailer/examples/scripts/shBrushPhp.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral29

Sample

stay-clean.org/PHPMailer/examples/scripts/shCore.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral30

Sample

stay-clean.org/PHPMailer/examples/scripts/shCore.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral31

Sample

stay-clean.org/PHPMailer/examples/scripts/shLegacy.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral32

Sample

stay-clean.org/PHPMailer/examples/scripts/shLegacy.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  stay-clean.org/PHPMailer/class.phpmailer.php
- Size 114KB
- SHA256 41cb3bf861102fa9b3574db5f2ea1d390b3fd1ff65d8b031b8a86f9e94f94a0d
- MD5 bdc722d1d36285d0ecf88fa33118b7a7
- SHA1 4e0a2e83a093b95f79331fe472640b51b8c52930
- SHA512 2b6c7d46f731f384598a939527f1189cb3b98f5f8dba4fd11add4267daae2e5cd2b7c575548162fe92ad1ff070592262acc5116cbcd8fcec5b791acd1392bce9
- SSDEEP 3072:BoVd/48OW0KJ7LvrFLid+qDrgAMtc9LtcDkl/9CBbu:qVd/XLvrHqDrgAMYLtcDkx9CBbu
- TLSH
  T1B4B3C8587AFB5CA1126364BE67CFA044E039B13B1519A992BCCC43F49F8473CD9B0AB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  stay-clean.org/PHPMailer/class.smtp.php
- Size 28KB
- SHA256 4909ed8de1801d74db855261e140e5b6ce5ea965b30e0646f0c9d1c6950cb705
- MD5 d2d06a5790e184191c73988864bdd1b4
- SHA1 52ad3780e40780de00682aaf392fc829782d0113
- SHA512 8f72372d07c78f40eee008226613c48c28c2231af3417d7861f76ad75fb95ab1177d881fe70e45491fad2f56233a37d8d903e4e163868fc5bd2a30964ac3fca2
- SSDEEP 384:06JyWlPoeEwCDSvsSaPWWdM/Y8y1JtDsHWymUzJzoJtJlUJRJLNyIqmJFJCbabbK:91+WElPWW+sRdnUtiH0zQkPCWf1ymFO
- TLSH
  T145D2B55935EB1832221315BAAB8FB085E236A52F12294D85BCAD5774AF0033CD7B1FF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  stay-clean.org/PHPMailer/docs/extending.html
- Size 3KB
- SHA256 2dc82d45b41d26140366787d4e58a8bdd9f4335d09912c283018c1d35a04b8c5
- MD5 7acc2b880e34473fa257b98c495e4cf6
- SHA1 8a827c663141cbb07266a8b0d993c4a8e6421be7
- SHA512 fe158e1daa95685c638cb0b3ad8c7a6aa94695fb56b322908bc09acf5a01f088cd00bcc232eafc79a56e57e6a3ea11cc96b8015cc38b6cd0bc7cb86000821926
- TLSH
  T15F71B714A99356E525A7B56AB38D70827C0541073A10F9B078DE43D8CF41C17FF7A6ED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  stay-clean.org/PHPMailer/docs/faq.html
- Size 1KB
- SHA256 34f1453d9d2bc915c8941a85d6c57f794daac895e174aac1609c3a5168016307
- MD5 dc17fa572db619e87e123cc5f0be3fb7
- SHA1 f19074833e4b60ebb891252065b0a0680a87e847
- SHA512 de4b2d64e2cd0811fa5cc9136a4da29c7df2fae2640278e7c301c0d2b59dd5fd002ae3304f476c65e06f3c38a869ec6dddab3c9b1eb0d3f447eaaec4934cdf15
- TLSH
  T14D31449BF79923551E6003602B5913A76B8970EEF50220E13DDEC1746B00A39AAF2DF4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  stay-clean.org/PHPMailer/docs/generatedocs.sh
- Size 241B
- SHA256 34a53dea37440b74674238dca41019047d81a018a174c506f5c0f760e2db5c87
- MD5 03f9b647a434ddd395fd9da3858291c1
- SHA1 df875650dc1dd4ee28f9ced8f882ddea5f976713
- SHA512 3ebcc1df65ad1986bb59ef913d707d27a35bef2690d05f4064accc7d1b0916c49d995f4fde6d3ab9a8313294180fa884599576631cc914de0028f1017f3066fe
- TLSH
  T1EDD097F932830C803A0E4A3DB6288361E992C34FA8D7E032880E02C8E8C051B79C7049
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  stay-clean.org/PHPMailer/examples/code_generator.phps
- Size 26KB
- SHA256 2c106bed4a8be326621cc2ce27b4c7b6b0d21d4998c3fe40b65a7d84c7c3c44f
- MD5 d5647ebfea705c9609a2ec521cae9076
- SHA1 87addb14c90de9e7e0d658ccaa788140ff1ce8e9
- SHA512 7d8ed363cb0172449a09969f2b5289a213400298c04e7c886574245aef50e45cc9e963c0a205d391e24f6c7486c82d5c0fff590d523cd51ab5184eb5c0ba5cf1
- SSDEEP 384:Ni5LteS+R4PzYpt5h0KnDiPixKozhN7oLYtR/c:k5LtkRKYlRmKEwN7oOU
- TLSH
  T1C1C27300A5F21D01A2A7A45677A568063ED9430BDA15DD903DCCABFF8F88C1BAC773D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  stay-clean.org/PHPMailer/examples/contents.html
- Size 693B
- SHA256 a56d5f3060076d43efa747f0f384aeb122987a13646b94fc752a9a37523b5a49
- MD5 f92bf4d6c327fc006359d8c2c94c13b2
- SHA1 5155c130b8c42183103d3971e37ee049b0214e7e
- SHA512 18b9be0de52926a166b4019255f75a03cee47e46fd13a4d6c53319951af3f6dd6ca9127bcdec5eaa56c0cb398b7d01ef2211e6f7d45f34385be52adf0d578764
- TLSH
  T1A101285AD0621207F781A74437B576D52DC0E34786EE44E471858456DD4F056FCF32AD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  stay-clean.org/PHPMailer/examples/gmail.phps
- Size 2KB
- SHA256 0cb5f2cd1de3269efa0b36526b26f1f99513be24342ef2114118f3c316cf92e5
- MD5 791e0dcef00d8d8af512eec0db9c6153
- SHA1 02c1a2597ff0c386dd38749d199aeaf4d448d7d4
- SHA512 21e3db21363a79e177bcd697989bf312827b4fa03cc8a93bdc88350a510d3d3f163487e10436d3464e2b52274db88be037b5282740321cd5e3b58f5286a497cf
- TLSH
  T1A04166216A900A119712F7E0B949705437B4424DFCC8B950D4DF50A5DAC6DABFFB22A7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  stay-clean.org/PHPMailer/examples/index.html
- Size 5KB
- SHA256 c98f3503bd4708d2edc2a3f8b907d10b9e73e59c7795000d90c143a333240394
- MD5 0cad8efa7173588a36da8802dd686bd3
- SHA1 e9cb7487dc874503ea1c431d5a6d702ca421c89d
- SHA512 86a5fa2eafc5f728288a9d1facd1563e5c91269ad5bf584c433baeaeefd13e7c8c4c288e01952489c59f06b2842b5bf8aedd6cc3e4384b8f6997886a7411394f
- SSDEEP 96:nBUP8NccYmLp4tFmdhjuHijG+L/QhYGPgdYHXcHixn1MeLDYXH/XFreAtB7jtO7y:mP8P4+dhju+TQhYGmYMgiXfXZlB7dSRK
- TLSH
  T17DC1E82BA3802327478213A57E25B398D33A815C4F60347724AF517AB401D6FFAF75D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  stay-clean.org/PHPMailer/examples/mail.phps
- Size 1KB
- SHA256 560340daf29308cd1d133a728f4a44f6fd93bb9367bf69a7fb745e289aa9d32c
- MD5 feb1d0136b3aa9a6bfd0634bcf932bec
- SHA1 eca84004f2e4d42de4b0821681f40d09962ac543
- SHA512 34621b33d7c309e2dffa38143a440c2a09582579f5c3e36d9451655cb0d4e0a4fbfb10d5633b6e842bc64b90ecf64ae044b5478850cdf68195da9c52b661e004
- TLSH
  T12721112169810E152716F5A431CE3060BDA2428DFD49F9A0D8CE8055DE96E1AFEF3BD9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  stay-clean.org/PHPMailer/examples/scripts/XRegExp.js
- Size 28KB
- SHA256 4532660fc8f3233252c0001b4f5b669c78b9c03092f8d5245c5395d7e104ee38
- MD5 efe8e33a85c643a52d846659a2ff991b
- SHA1 7043746882506d33952f22178e38e0ffa1010d00
- SHA512 8c39a25a72448a8002b2e8f5bdb82fb6fa94bfb5a9bef868734fb1e05d4595aa118f6dfa7e6beed288ccd37a2f111522d2a50396b1ee29f9b6b4d4750d887e0e
- SSDEEP 768:hhnjoETDtC4065gPkkwrHGikflrfOD4Xs8f6g:TjoETDO65gbwrmrH
- TLSH
  T14AD296996D8260619662F06C07EF6448EB3AB427965CD400FD8D43983F91A3D42FDBFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  stay-clean.org/PHPMailer/examples/scripts/shAutoloader.js
- Size 2KB
- SHA256 24c0f92f62b00f6a8a72aeaff24b40d1d89f74adf273e78ca9afca861f778b15
- MD5 f78de5021de4a54aece26edd18973f9d
- SHA1 b90fb89adb3175595ac535ac0e88f60b0198d563
- SHA512 225ec48adffa706e88ee600a2951081b85e71be2b1c1f240e7ab9224234e3a4e18ee0f5f72e37eb3e34a56a18e121f35c7dcf0092358edcd9eee96c03d0e66fd
- TLSH
  T1F9512F14EE1CF22A0674203F897FC4A95E3D45333615C497B98CA8A895A4BDE8C4FE91
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  stay-clean.org/PHPMailer/examples/scripts/shBrushPhp.js
- Size 4KB
- SHA256 5f26f9f8952ae6542ecb40ee10990b73962c9efae09f266d0a6c9ec869006823
- MD5 46cfa6ac0882fef215b55d82cd19cee5
- SHA1 f73beca9012ea93b094c5bdbe7f461e6cbb48da6
- SHA512 aefacdb1e3bd453014095c4ac47a7be28afd8e1cd12f7a7f1a3551e02cb2c00aa57422ad8adeeac6a3daa6ad9799b7217f63e220878c79409367d3d181da65fd
- SSDEEP 96:2GN6vpnbxcc1qA5I7V/0hu1soUkLTLm+CCuBP8Po:2wUq0I7oysjkLfm+WqQ
- TLSH
  T142A1D7D4596E34BD48D124FAAE0D908BD91F90F223591004BF368C9D20B2C8E61B667F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  stay-clean.org/PHPMailer/examples/scripts/shCore.js
- Size 19KB
- SHA256 02dac3b85b44a6b4734725275d7c565317375194e7f48a4d47a70253ac435892
- MD5 10a2b8ed4198a1508d0f5db401b2db71
- SHA1 c53e30a2dd0d57fa4a2159896ad6b2362a32c9be
- SHA512 cf29c74f778192b9a47a6991442ca96b4073433a4f436b8ccb911d46ab4adabc4eea553cb7039cfe30e4cdc5aa18d75458e2d86f125425e13fbd1632602d7361
- SSDEEP 384:nqHhJEO4dmiC84z8PfuDnXV51zreUwZGUdE3hfj1Mh0psz9CSnDb4bulJqii:nwLEO4JfuDXZK5dE3J1rtawClJS
- TLSH
  T13C92B9C83795F0A253A135AC14EF550AE23A3E8A6C5D9004FA59D8E57CB4F0B427BF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  stay-clean.org/PHPMailer/examples/scripts/shLegacy.js
- Size 3KB
- SHA256 e8092cf8585888c0f99f63de3fb6b22418274b4ef7a32c2c9d06a782b0622969
- MD5 0ff5ee4cd516bb489ccc65bb4ab652c5
- SHA1 7f0dca6f9890908ebaf9f16dede6d3fe9ce7a2b1
- SHA512 a0eb3c4a7677e460360982556e7007b58bcf47d06cdf26120e7fdef751bc5219ec8e09a524b1be9a9cf5846470149a3cedc53c0a3f961fbc8dcff26a3dba25ff
- TLSH
  T1B56122C2F78EB19852A630372D9ED48F482C4EB31614BDE1FC5C96907861C0792D7A24
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32

© 2018-2026

Terms | Privacy