MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5441e0018012a2496a38a8dbc3010e86e0094be7971e4f400ae50457efcd87fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5441e0018012a2496a38a8dbc3010e86e0094be7971e4f400ae50457efcd87fa
SHA3-384 hash:	0d20e883135e777024bcaa011d499d2ce83f52ddc84c206779e4544fbb0a0aae5833eaa84d2896e64deb409b932cd92a
SHA1 hash:	23db3e96a94b92216aff762b766525098b9eecdd
MD5 hash:	372953b658f52118435afb13382bd81a
humanhash:	mississippi-johnny-seventeen-twenty
File name:	WoodenestProtonotary.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	156 bytes
First seen:	2022-12-19 13:15:29 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3:cc7oatMdMQsLWmW7pFH+GWZudV3ZmF5XLCNNKQL2mECKSSWbrJFPzJH:3rMFrYudV3YF5XLiKQL2zfhuvR
TLSH	T1F4C08C861AB2CACF13CF02F622A8D4984352DE4C2406C808AE94C8CC021C9820B0A330
Reporter	pr0xylife
Tags:	1671442875 BB11 js Qakbot Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

244

Origin country :

PT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.JS.Qakbot.RV.MTB.4781.30332.UNOFFICIAL

Alert

Create hunting rule

FileScan.io

Gathering data

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5441e0018012a2496a38a8dbc3010e86e0094be7971e4f400ae50457efcd87fa/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kra6aamackres2ryvdn4gaioq3qass7hs4pe6qak4ucfp36nq75a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/221219-qhtxnafa84/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.15

Link:

https://yomi.yoroi.company/submissions/5441e0018012a2496a38a8dbc3010e86e0094be7971e4f400ae50457efcd87fa