MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fc9c32a7a88ad193cf3d24d25a93ddec1f20141a2d50fd68f5c77115abff5e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2fc9c32a7a88ad193cf3d24d25a93ddec1f20141a2d50fd68f5c77115abff5e8
SHA3-384 hash:	d6c92df934eaa94efebfa8e72ad03fad31996cff188ac740a686366b2d09e900dd8acbade5de6a95cb9b8844005b4777
SHA1 hash:	4891e0addcc5ae02992699bb4370451dabf6ffc0
MD5 hash:	d6637eef607e0f1ba48dd9bad3b70f03
humanhash:	floor-enemy-texas-fourteen
File name:	hx9RP3BV.js
Download:	download sample
Signature	AZORult Alert Create hunting rule
File size:	1'044 bytes
First seen:	2024-01-21 17:28:27 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	24:iJFacEC+Czzf5j1IsiRI4QAxBwlVICb1P/vMiKDKj:E7EP8Vj6x+jlXvMvOj
TLSH	T1AE1135521838DE4D43453B88942AAD6E86B013236B85F2F6746CC5CDF770110C9E6537
Reporter	rmceoin
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

312

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.3404.14917.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

86%

Tags:

anti-vm evasive obfuscated powershell

Link:

https://www.filescan.io/uploads/65ad545edca4dca481df18e1/reports/f43f6b7c-f60d-4171-9d26-a92cc678bea5/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/2fc9c32a7a88ad193cf3d24d25a93ddec1f20141a2d50fd68f5c77115abff5e8

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1378321

Signature

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

66%

Verdict:

Susipicious

File Type:

ASCII

Link:

https://malprob.io/report/2fc9c32a7a88ad193cf3d24d25a93ddec1f20141a2d50fd68f5c77115abff5e8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2fc9c32a7a88ad193cf3d24d25a93ddec1f20141a2d50fd68f5c77115abff5e8/

ReversingLabs TitaniumCloud Script-JS.Trojan.Cryxos

Threat name:

Script-JS.Trojan.Cryxos

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-01-21 17:29:04 UTC

File Type:

Text (JavaScript)

AV detection:

11 of 38 (28.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f7e4gkt2rcwrspht2jgslkj533a7eakbulkq7vuplr3rcwv76xua._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/240121-v2jy1sfahn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.