MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 51ffefa8a10b6da720a80cec4735fe173669e7c974946e46c8dda908e824d8a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 51ffefa8a10b6da720a80cec4735fe173669e7c974946e46c8dda908e824d8a4 |
|---|---|
| SHA3-384 hash: | 98114977d3d65705fae1aa084c92e3bd3a87a8383d6ba71aed2bb6dd11d0a08ac180c5f18153dd9291ac7f0d5e317858 |
| SHA1 hash: | 5b5adb2f6e9d9536fd9bcdd37b2945350477b479 |
| MD5 hash: | 86c0064011ea2d6fb66faa6ab11c5939 |
| humanhash: | michigan-whiskey-river-alpha |
| File name: | Yigdaagb.js |
| Download: | download sample |
| File size: | 267'347 bytes |
| First seen: | 2023-05-19 09:56:23 UTC |
| Last seen: | 2023-05-19 09:56:27 UTC |
| File type: |  js |
| MIME type: | text/plain |
| ssdeep | 6144:Q4ldaPTJ3ryq+kbRQZ1VGHUvcyVcuysJ1a+stko7vNDmaOxhL:Hf |
| TLSH | T14244FEC04F1518704B4B7D267770A5A1EBBD0E6482889A9BE91F3271F2CE68CCDD9B35 |
| TrID | 65.2% (.CFC) ColdFusion Component (with rem) (7500/1/1) 34.7% (.S) Digital Micrograph Script (4000/1/1) |
| Reporter |  JAMESWT_WT |
| Tags: | js |
Intelligence
File Origin
# of uploads :
2
# of downloads :
253
Origin country :
ITVendor Threat Intelligence
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Verdict:
Malicious
Labled as:
Trojan.Cryxos.JS
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Signature
Encrypted powershell cmdline option found
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Potential dropper URLs found in powershell memory
Very long command line found
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2023-05-18 15:05:31 UTC
File Type:
Text (JavaScript)
AV detection:
8 of 24 (33.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Blocklisted process makes network request
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
js 51ffefa8a10b6da720a80cec4735fe173669e7c974946e46c8dda908e824d8a4
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.