MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 412d8ed2b5c5aa3eb0487ca19b47426c2631fbaff5900be52e3c978477d52500. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	412d8ed2b5c5aa3eb0487ca19b47426c2631fbaff5900be52e3c978477d52500
SHA3-384 hash:	25c1c569d64375ed9b07d80df578ffc63e23fc58aceecb001dab6ecf1c6fdb2d72d207d7cbcb656da92aa03197689fe9
SHA1 hash:	13035d1bb797595647c340831a3c181b26aa207f
MD5 hash:	ecc0040c784bb50f6f5ec958a14d82a8
humanhash:	steak-sweet-six-massachusetts
File name:	HNd1yYNoxyID.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	336'280 bytes
First seen:	2023-06-13 17:21:01 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbi1GnggnMhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygN
TLSH	T1F9645389AA45E0F08137B337CA574410FA6B1E5B2084C972B97C505D2F3D86D7ABBED8
Reporter	pr0xylife
Tags:	1686673959 BB32 js Qakbot Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

358

Origin country :

DE

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6488a57fb82d716c5afe93a0/reports/ad58909a-5fef-4086-a032-bd917ff6d90f/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/412d8ed2b5c5aa3eb0487ca19b47426c2631fbaff5900be52e3c978477d52500

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1253814

Signature

Encrypted powershell cmdline option found

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Very long command line found

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/412d8ed2b5c5aa3eb0487ca19b47426c2631fbaff5900be52e3c978477d52500/

ReversingLabs TitaniumCloud Script-JS.Downloader.Heuristic

Threat name:

Script-JS.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-13 17:22:06 UTC

File Type:

Text (HTML)

AV detection:

1 of 37 (2.70%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iewy5uvvywvd5mcipsqzwr2cnqtdd65p6wiaxzjohslyi56veuaa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230613-vw11caaa5z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/412d8ed2b5c5/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/412d8ed2b5c5aa3eb0487ca19b47426c2631fbaff5900be52e3c978477d52500