MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f948bcd8c16b6e2c20fec3e9126a730b835888a4f071391c7847b00a27d8dd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3f948bcd8c16b6e2c20fec3e9126a730b835888a4f071391c7847b00a27d8dd8
SHA3-384 hash:	d520fc3833c43a84d897095816d7e0c99291710594426bb3c49e4deddc10c89f5e7857ae167eb9b8622ec29a59e754f2
SHA1 hash:	7fb5cf0c74dfe53a87dd66a96699a245b69bff62
MD5 hash:	6cd9c64a0529b03d105ed83dc7ac9a37
humanhash:	cat-enemy-finch-potato
File name:	Document-v05-53-20.js
Download:	download sample
Signature	Latrodectus Alert Create hunting rule
File size:	321'282 bytes
First seen:	2024-11-13 06:15:06 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:23L5OgSHWLjOBeJz2FQhpqan7tJmWeCLj/yZSmK/my4HoYQ1vU8VoEOrG:sZF2Iqis2/5p4HQfoC
Threatray	241 similar samples on MalwareBazaar
TLSH	T1B2645CA0EA4002261F936B9F9E5219D2AD2CC51187122A18F5AF039D1FC79D8E37DF7D
Magika	txt
Reporter	k3dg3___
Tags:	BruteRatel BruteRatelC4 js Latrodectus TA578

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

3'634

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.22236.28839.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Unknown

Verdict:

Suspicious

Score:

50.0%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6735182d34b6906b348281ce

Tags:

java html

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67344423d64ed6dcf6de5bbb/reports/79cc488b-f134-421f-8ada-165b338fec60/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3f948bcd8c16b6e2c20fec3e9126a730b835888a4f071391c7847b00a27d8dd8

Joe Sandbox BruteRatel, Latrodectus

Result

Threat name:

BruteRatel, Latrodectus

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1554896

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Drops executables to the windows directory (C:\Windows) and starts them

Found malware configuration

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Query firmware table information (likely to detect VMs)

Sample has a suspicious name (potential lure to open the executable)

Sample uses string decryption to hide its real strings

Sets debug register (to hijack the execution of another thread)

Sigma detected: RunDLL32 Spawning Explorer

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected BruteRatel

Yara detected Latrodectus

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

7%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/3f948bcd8c16b6e2c20fec3e9126a730b835888a4f071391c7847b00a27d8dd8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3f948bcd8c16b6e2c20fec3e9126a730b835888a4f071391c7847b00a27d8dd8/

ReversingLabs TitaniumCloud Win32.Dropper.Generic

Threat name:

Win32.Dropper.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2024-11-13 06:16:05 UTC

File Type:

Text (AutoIt)

AV detection:

1 of 38 (2.63%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h6kixtmmc23ofqqp5q7jcjvhgc4dlcekj4drheohqr5qbit5rxma._file

Threatray bruteratelc4 latrodectus

Verdict:

malicious

Label(s):

bruteratelc4

Alert

Create hunting rule

latrodectus

Alert

Create hunting rule

Similar samples:

07282b92613d88cdeb02dc30835216268c7ec378bb0ff7a08bb280775a8f82c3

Latrodectus

1822636a57752d06999da566e21c16b1f0dc465e225af2c2afba6ffb1cde0512

Latrodectus

3f948bcd8c16b6e2c20fec3e9126a730b835888a4f071391c7847b00a27d8dd8

Latrodectus

620deee533806435220710d4ac4bd7810e04cb8d21fd80293785cd6b9235ca75

Latrodectus

error

Latrodectus

f02ba578e0f962f6be46187b288e22a4dbe972878893ecb81ff5f33944aef4b4

Latrodectus

fd4b6e419691647b9ae0ca60e5b383c5d9fe1d5fcfc8dec887bb188c4d39d36e

Latrodectus

+ 231 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/241113-g1fy3swmgs/

Behaviour

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

System Location Discovery: System Language Discovery

Drops file in Windows directory

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.48

Link:

https://yomi.yoroi.company/submissions/3f948bcd8c16b6e2c20fec3e9126a730b835888a4f071391c7847b00a27d8dd8