MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 325e486140498c768d75e86b2139832ae5fb99960c3a5e5ab1aef3940146850a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	325e486140498c768d75e86b2139832ae5fb99960c3a5e5ab1aef3940146850a
SHA3-384 hash:	e5119d84a5b824dece80c9efe6b814b5d92c7dbc0de88ada894abfbfa9065b23cdab8cee6faef60f4f666a60cce9b521
SHA1 hash:	be57755e24d4da1e93338372aa21131baab0249c
MD5 hash:	6a4e2f02cdfc0f80dcc97242de4b0176
humanhash:	queen-skylark-cat-pizza
File name:	NopY4bIQt2Z7wr.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	355'068 bytes
First seen:	2023-06-14 07:47:30 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbBKLMAbOU4P/hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygw
TLSH	T1F5743385AA41E0F18237B33BDA175410FA6B1E5B20848972BD7C51582F3D86D7EF7E88
Reporter	JAMESWT_WT
Tags:	js Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

323

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.HEUR.Trojan-Downloader.Script.Agent.gen.21703.25937.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/648970b77604c3d738768bfe/reports/f5663bfd-29c8-45c6-a78f-e3ea123c626c/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/325e486140498c768d75e86b2139832ae5fb99960c3a5e5ab1aef3940146850a

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/325e486140498c768d75e86b2139832ae5fb99960c3a5e5ab1aef3940146850a/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gjpeqykajgghndlv5bvscomdfls7xgmwbq5f4wvrv3zziakgqufa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230614-jm5fmaeg5w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/325e48614049/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/325e486140498c768d75e86b2139832ae5fb99960c3a5e5ab1aef3940146850a