MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b3e3c12210767938b8b0574c31c17ac4246fefce53d0a34080a685946e8f4a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1b3e3c12210767938b8b0574c31c17ac4246fefce53d0a34080a685946e8f4a8
SHA3-384 hash:	b1c566d3618d22b2b20c22c7ee407faf4f70f957217e43ae6869c4b197252e7af45ffea84403a26241e5908e4d95e8ff
SHA1 hash:	f6f539e0c8ab0181adb27f223b9e1ea2a0fd7ebb
MD5 hash:	408af5a57a98f7c8c9dd66134a0867f5
humanhash:	tango-beryllium-timing-september
File name:	WnDK3vYAwLWFS.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	322'608 bytes
First seen:	2023-06-14 07:40:04 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb3jP2YjxuhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygt
TLSH	T1B26432496A51E0F48237F33BCA178410FA6B1F1B21848972B97C505D6F3D85D6ABBEC8
Reporter	JAMESWT_WT
Tags:	js Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

283

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/64896f0f42386ee977f41bd3/reports/32b65fdc-77d7-44b7-9e62-26c8c67cb5db/overview

Hybrid Analysis JS/Agent.QVM trojan

Verdict:

Suspicious

Labled as:

JS/Agent.QVM trojan

Link:

https://www.hybrid-analysis.com/sample/1b3e3c12210767938b8b0574c31c17ac4246fefce53d0a34080a685946e8f4a8

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox Qbot

Result

Threat name:

Qbot

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1254262

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Downloads files with wrong headers with respect to MIME Content-Type

Encrypted powershell cmdline option found

Found malware configuration

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Powershell drops PE file

Sample uses string decryption to hide its real strings

Snort IDS alert for network traffic

Very long command line found

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Qbot

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1b3e3c12210767938b8b0574c31c17ac4246fefce53d0a34080a685946e8f4a8/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dm7dyerba5tzhc4lav2mghaxvrben7x44u6qunaibjufsrxi6sua._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230614-jhlgysef5t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1b3e3c122107/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1b3e3c12210767938b8b0574c31c17ac4246fefce53d0a34080a685946e8f4a8