MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b04eb3c0f95ecd1e2a5b74275d82ce3d92f8b153774a59fb7243d39b1b56ae9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2b04eb3c0f95ecd1e2a5b74275d82ce3d92f8b153774a59fb7243d39b1b56ae9
SHA3-384 hash:	adbbead447887cd1e1e30e29ff70c06bd2c8e0edfa186d0636943f88c60ebc55fa278e0f21003aa9e3f7fdc53706bfa6
SHA1 hash:	d1793f4c3c1a4edeb6f733357ca8905e6fa384c9
MD5 hash:	493f69ec7712ffa62e867ad4d1782032
humanhash:	hotel-spaghetti-bakerloo-bacon
File name:	ave6608.js
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	49'449 bytes
First seen:	2023-07-08 08:27:21 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:mj+yH/l9fdyDlNT4kBPZT3ezR++ag4yuCdIfqMrWVE0rZj4P/T:myyH/ndyDlNT4mPlu+BOuKIfqYgZjyT
TLSH	T18623C6CA3AD7F861431313B2375626E6E179DC91A5C888CCF414BC9CF5ACA1DF2A65C8
Reporter	abuse_ch
Tags:	deperekanuki1-com deperekanuki2-com js NetSupport

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

299

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.GT.JS.Backdoor.2.0836D072.6534.24481.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/64a91e1cdbb9e835463f01b1/reports/e82e0217-70a5-4e52-8ff5-974e4e2b6c49/overview

Hybrid Analysis GT:JS.Backdoor.2

Verdict:

Malicious

Labled as:

GT:JS.Backdoor.2

Link:

https://www.hybrid-analysis.com/sample/2b04eb3c0f95ecd1e2a5b74275d82ce3d92f8b153774a59fb7243d39b1b56ae9

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2b04eb3c0f95ecd1e2a5b74275d82ce3d92f8b153774a59fb7243d39b1b56ae9/

ReversingLabs TitaniumCloud Script-JS.Backdoor.Heuristic

Threat name:

Script-JS.Backdoor.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-07 12:58:36 UTC

File Type:

Text (JavaScript)

AV detection:

3 of 38 (7.89%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fmcowpapsxwndyvfw5bhlwbm4pms7cyvg52klh5xeq6ttmnvnluq._file

Hatching Triage netsupport

Result

Malware family:

netsupport

Alert

Create hunting rule

Score:

  10/10

Tags:

family:netsupport rat

Link:

https://tria.ge/reports/230708-kdkkjaeb3t/

Behaviour

Checks processor information in registry

Download via BitsAdmin

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Drops file in System32 directory

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

NetSupport

Malware Config

Dropper Extraction:

https://virvatulishop.com/labda.zip
https://virvatulishop.com/files/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2b04eb3c0f95/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2b04eb3c0f95ecd1e2a5b74275d82ce3d92f8b153774a59fb7243d39b1b56ae9