MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1036fb7a192b5b9dcaadac2f984feacfe7146750116afa27f691f2d5ac4ffbe3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1036fb7a192b5b9dcaadac2f984feacfe7146750116afa27f691f2d5ac4ffbe3
SHA3-384 hash:	d377deba689ccd904bee69dd45aa5cd6baf7608483abeac1c374dd67ed4557a157b8feec114edafcd5c3a185adea7a34
SHA1 hash:	66c181a6a39269b07398851080bb2f00571b02ec
MD5 hash:	47bee23df74ae0ec56188d9ecf633886
humanhash:	georgia-black-illinois-robin
File name:	clienti.js
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	494'204 bytes
First seen:	2023-05-31 10:49:37 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12288:P+pNdyBNdyANdyrNdyrNdyc8CEIw52ALeyEiuEitSJxU5TsTGTwQ:0/yB/yA/yr/yr/yctw52AqB0OSJS5wi7
TLSH	T1FEB412858B128FFCFB281AED143C29CC6A787D753E50E5E1D52B24538D23B6510A3A7B
Reporter	JAMESWT_WT
Tags:	brt Gozi isfb js Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

342

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Trojan.Cryxos.12167.1195.5345.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

dropper lolbin obfuscated regsvr32

Link:

https://www.filescan.io/uploads/6477265be6cc9218e8eb7bfe/reports/e9545396-4a89-4d01-91a1-61feec8161b7/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/1036fb7a192b5b9dcaadac2f984feacfe7146750116afa27f691f2d5ac4ffbe3

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1246006

Signature

JavaScript file contains suspicious strings

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1036fb7a192b5b9dcaadac2f984feacfe7146750116afa27f691f2d5ac4ffbe3/

ReversingLabs TitaniumCloud Script-JS.Trojan.Ursnif

Threat name:

Script-JS.Trojan.Ursnif

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-05-31 10:50:05 UTC

File Type:

Text

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ca3pw6qzfnnz3svnvqxzqt7kz7triz2qcfvpuj7wshznllcp7prq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230531-mw82yseg2y/

Behaviour

Modifies system certificate store

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.61

Link:

https://yomi.yoroi.company/submissions/1036fb7a192b5b9dcaadac2f984feacfe7146750116afa27f691f2d5ac4ffbe3