MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49a5211bb7c51f668aa30c23c297d96d73760b7fd6f806696b60f72e38633743. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	49a5211bb7c51f668aa30c23c297d96d73760b7fd6f806696b60f72e38633743
SHA3-384 hash:	078fbbe5bf558076055462ff8608193d54103a6e9fede806ff9dd8ee0a7ea95d31798143c694b332b6546d3b8c7c27bc
SHA1 hash:	c29ac7889c10ee2dc9f83c1a2e0ed2b5ed9dbbe5
MD5 hash:	0c71e619515fd2d52375f4a80f7d9c5c
humanhash:	texas-uniform-december-yellow
File name:	hTKT9F5vsyw7Ho.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	347'283 bytes
First seen:	2023-06-14 06:58:42 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbJdvNMUlOhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygB
TLSH	T1EC7433896A45E0F14137B377DA578410FAAB1F1B21848936B97C515C2F3D82CBEB7E88
Reporter	JAMESWT_WT
Tags:	js Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

264

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6489653a4a646ec4b5664ba1/reports/598d945a-f07a-4b49-8c11-63b0a54d80e6/overview

Hybrid Analysis JS/Agent.QVM trojan

Verdict:

Suspicious

Labled as:

JS/Agent.QVM trojan

Link:

https://www.hybrid-analysis.com/sample/49a5211bb7c51f668aa30c23c297d96d73760b7fd6f806696b60f72e38633743

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/49a5211bb7c51f668aa30c23c297d96d73760b7fd6f806696b60f72e38633743/

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jgsscg5xyupwncvdbqr4ff6znvzxmc37234am2llmd3s4oddg5bq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230614-hr38paea9t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/49a5211bb7c5/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/49a5211bb7c51f668aa30c23c297d96d73760b7fd6f806696b60f72e38633743