MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e2b09b042b5d3ef3e60311c3a0950b85977eb0f786830fe97c6bef460b357d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1e2b09b042b5d3ef3e60311c3a0950b85977eb0f786830fe97c6bef460b357d5
SHA3-384 hash:	eaf78874fde6f98aa0b00721c07a43970c030b9f367dd856635d653559e64cb8fb5fdc889cbe012233a1d464d135fe40
SHA1 hash:	edfbff487e767178dde5d5373549c54543fb963d
MD5 hash:	4140e18b79ba35de747108781bb557c0
humanhash:	five-oscar-berlin-florida
File name:	fl1775.js
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	52'062 bytes
First seen:	2023-07-08 08:27:13 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	1536:oEdD5bLOlMQppS/qQaSv47gPyfbsSjDEg:oEdD5bLkaBac4/bsCt
TLSH	T1AD3374CD36D2FA5A52430371375671A9D63ACC4154895C8CF014FCACF6ACA3DBBAA58C
Reporter	abuse_ch
Tags:	deperekanuki1-com deperekanuki2-com js NetSupport

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

296

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.GT.JS.Backdoor.2.4E0155B6.14163.4466.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

88%

Tags:

obfuscated powershell

Link:

https://www.filescan.io/uploads/64a91e184b573cca625d822a/reports/da68e4d1-5048-4bbe-97ce-505ba62a3159/overview

Hybrid Analysis GT:JS.Backdoor.2

Verdict:

Malicious

Labled as:

GT:JS.Backdoor.2

Link:

https://www.hybrid-analysis.com/sample/1e2b09b042b5d3ef3e60311c3a0950b85977eb0f786830fe97c6bef460b357d5

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1e2b09b042b5d3ef3e60311c3a0950b85977eb0f786830fe97c6bef460b357d5/

ReversingLabs TitaniumCloud Script-JS.Backdoor.Heuristic

Threat name:

Script-JS.Backdoor.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-07 12:58:34 UTC

File Type:

Text (JavaScript)

AV detection:

3 of 38 (7.89%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dyvqtmccwxj66ptageoduckqxbmxp2yppbudb7uxy27piyftk7kq._file

Hatching Triage netsupport

Result

Malware family:

netsupport

Alert

Create hunting rule

Score:

  10/10

Tags:

family:netsupport rat

Link:

https://tria.ge/reports/230708-kdj9rseb2z/

Behaviour

Download via BitsAdmin

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

NetSupport

Malware Config

Dropper Extraction:

https://turvavalaisin.fi/loco.zip
https://turvavalaisin.fi/files/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1e2b09b042b5/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1e2b09b042b5d3ef3e60311c3a0950b85977eb0f786830fe97c6bef460b357d5