MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ee2ad7b70f34878d0bf1122fb34603ebe6723e5773412a0be8c0577309a8cc0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1ee2ad7b70f34878d0bf1122fb34603ebe6723e5773412a0be8c0577309a8cc0
SHA3-384 hash:	2a1aabf56419d5e9fa5e05e4b8a738bdb0e2bcc10f720e14f3536c1b115b90da390c980b5a1c00a48ca07273f74731c3
SHA1 hash:	4295d3f4b7cf96051842be8b3e946c1c4b568a0a
MD5 hash:	5b8f7f144d4b0d6acc2e32350461f555
humanhash:	network-sodium-video-oranges
File name:	notepad3285.js
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	47'015 bytes
First seen:	2023-07-08 08:27:07 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:qhDWXgAYSt91THAmMiHA3HfLjgRtXwOfDVSFKgQZPrnQ/i:qhSXgtSt91TtDMHffgRFVSFKgur
TLSH	T11223B4CA37E6F851496723B23B5762D6D13CAD81D4C8D8CCF052B85CF9A8A3CF668644
Reporter	abuse_ch
Tags:	deperekanuki1-com deperekanuki2-com js NetSupport

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

294

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.GT.JS.Backdoor.2.EF7AF4D0.11980.22941.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated powershell

Link:

https://www.filescan.io/uploads/64a91e1582e04d1583949857/reports/974b43e7-f417-47ed-85a8-5877555cbe40/overview

Hybrid Analysis GT:JS.Backdoor.2

Verdict:

Malicious

Labled as:

GT:JS.Backdoor.2

Link:

https://www.hybrid-analysis.com/sample/1ee2ad7b70f34878d0bf1122fb34603ebe6723e5773412a0be8c0577309a8cc0

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1ee2ad7b70f34878d0bf1122fb34603ebe6723e5773412a0be8c0577309a8cc0/

ReversingLabs TitaniumCloud Script-JS.Backdoor.Heuristic

Threat name:

Script-JS.Backdoor.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-07 12:58:36 UTC

File Type:

Text (JavaScript)

AV detection:

3 of 38 (7.89%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d3rk263q6nehruf7cerpwndah27goi7fo42bfif6rqcxome2rtaa._file

Hatching Triage netsupport

Result

Malware family:

netsupport

Alert

Create hunting rule

Score:

  10/10

Tags:

family:netsupport rat

Link:

https://tria.ge/reports/230708-kdj9rseb2x/

Behaviour

Download via BitsAdmin

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

NetSupport

Malware Config

Dropper Extraction:

https://virvatulishop.eu/costa.zip
https://virvatulishop.eu/files/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1ee2ad7b70f3/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1ee2ad7b70f34878d0bf1122fb34603ebe6723e5773412a0be8c0577309a8cc0