MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02cd4ea997bbaad37b7aa99971c2b623a1ff9ee615c47b35ecd641ae950c1988. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	02cd4ea997bbaad37b7aa99971c2b623a1ff9ee615c47b35ecd641ae950c1988
SHA3-384 hash:	578b9b20a4e333a53602df08b25996183f388b0ad3fb9c823df12d98dd9ac196c4a6224573ebdd73c36cc6980b35ba57
SHA1 hash:	99e1e21ba11f4223f507b3be1bfcb3c32cb9ce5c
MD5 hash:	98ee3c498fa4ef69a09b7f84f092cbdd
humanhash:	louisiana-blossom-river-texas
File name:	susp.js
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	21'577 bytes
First seen:	2023-05-19 01:48:01 UTC
Last seen:	2023-05-31 10:33:30 UTC
File type:	js
MIME type:	text/plain
ssdeep	384:j03wqvR/MfljeBiMBC7b+jH0U3puaL02kECO:jOwqvR/yjQii+KH0U3plL4ECO
TLSH	T164A263E192D93C7D587762F4092841E1D5A68876BA5E1CE4F02DB05CF70CB24D2BACAF
Reporter	JAMESWT_WT
Tags:	js vipbeed-com

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

311

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

86%

Tags:

nemucod obfuscated remcos

Link:

https://www.filescan.io/uploads/6466d558c65707af64435b72/reports/d338b517-d533-42a0-bdc6-d3271d88e6a4/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/02cd4ea997bbaad37b7aa99971c2b623a1ff9ee615c47b35ecd641ae950c1988

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1236471

Signature

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

JScript performs obfuscated calls to suspicious functions

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/02cd4ea997bbaad37b7aa99971c2b623a1ff9ee615c47b35ecd641ae950c1988/

ReversingLabs TitaniumCloud Win32.Trojan.Ursnif

Threat name:

Win32.Trojan.Ursnif

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-18 20:19:41 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=algu5kmxxovng632vgmxdqvweoq77hxgcxchwnpm2za25fimdgea._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230519-b759naee34/

Behaviour

Script User-Agent

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.68

Link:

https://yomi.yoroi.company/submissions/02cd4ea997bbaad37b7aa99971c2b623a1ff9ee615c47b35ecd641ae950c1988