MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3257e69fb1e0c27d7cac1ce85f2c4156797be1979e33744e991a1e1998a3b281. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3257e69fb1e0c27d7cac1ce85f2c4156797be1979e33744e991a1e1998a3b281
SHA3-384 hash:	327ca58cea660255855112e9b3b2359fb06919438a263e81f7a2e8d3a7416a0a862e76b2b5e279789cd4b6f9b96a436e
SHA1 hash:	ba24ca545dbd592737d9469bad6eeee04923c927
MD5 hash:	adf3c31cee0e42114ee1697284435c80
humanhash:	west-equal-twenty-mirror
File name:	741.zip
Download:	download sample
Signature	Pikabot Alert Create hunting rule
File size:	73'517 bytes
First seen:	2023-05-25 13:33:04 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	1536:/Zp/1RTmCiHIVsT2BF5bVBvzCmsPRZJZIVJl3Wr5z5h:/ZpNRqjHwhBF5vGmARZJm53W5r
TLSH	T1F67302E1A4B24312D0CBA7CA2560FE439FD560838ED5AB5D87521F0439232D73A5FF5A
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	Mangusta
Tags:	Pikabot zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

155

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Uqrpron.js
File size:	209'785 bytes
SHA256 hash:	10bd91ba36cabea0d4a6f09b7ca380681c62b73e5dc01ad02cfbacfb0a2a6eb7
MD5 hash:	446b0969676e89059e1c4890687e7901
MIME type:	text/plain
Signature	Pikabot

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.29031.BadJs.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/3257e69fb1e0c27d7cac1ce85f2c4156797be1979e33744e991a1e1998a3b281/results/dashboard

Payload URLs

URL

File name

http://www.gnu.org/licenses/

JS File

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/646f63cb74f29291dfe66e41/reports/f3356516-2787-408b-855e-971be82c938b/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/3257e69fb1e0c27d7cac1ce85f2c4156797be1979e33744e991a1e1998a3b281

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/3257e69fb1e0c27d7cac1ce85f2c4156797be1979e33744e991a1e1998a3b281

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3257e69fb1e0c27d7cac1ce85f2c4156797be1979e33744e991a1e1998a3b281/

ReversingLabs TitaniumCloud Script-JS.Trojan.Cryxos

Threat name:

Script-JS.Trojan.Cryxos

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-25 12:47:49 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

6 of 36 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gjl6nh5r4dbh27fmdtuf6lcbkz4xxymxtyzxituzdipbtgfdwkaq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230525-q2dpsabb5t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.