MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6327980bf380ad765b53f7b3411471c9069e0ad2a7ec3f247b8a8bd3fc8b6fde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6327980bf380ad765b53f7b3411471c9069e0ad2a7ec3f247b8a8bd3fc8b6fde
SHA3-384 hash:	4e8a703e693422e8f0f81ae47d9ed2775d7a546f5a74ffa762ca99bf5599db00a8370e38daf5d5657e16c1e626293fc7
SHA1 hash:	0ee71ce15a658ba1c53cd1a17e9ad8606d827712
MD5 hash:	d0ab05d61e8e0aa53b0828a54aad48a6
humanhash:	magazine-october-bacon-kansas
File name:	Auto.Uрdаtе.zip
Download:	download sample
Signature	SocGholish Alert Create hunting rule
File size:	9'782 bytes
First seen:	2022-11-25 19:07:51 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	192:RFGGWgGWkkABafVRAVHBgiMLNJHsZPsLulX3qS/g49Oh4/Apxu:RgnWJ9fVR6gi2bHLMJRm4Gu
TLSH	T1F012BE792A05807C3AC9BF6626A701C9D61E06FF105527B0E8258F5F6EF95539E083D1
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	snowdarkz
Tags:	socgholish zip

snowdarkz

infected site > myfood.silverspringfoodproject[.]org > this sample

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

371

Origin country :

DE

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	AutoUpdate.js
File size:	24'707 bytes
SHA256 hash:	f03cb5c611103d657ef2d5c5cb11cb2550405c703b8911b6b9f00fb872472498
MD5 hash:	856d212b5bc1f4ac238d8812832fac85
MIME type:	text/plain
Signature	SocGholish

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL

Alert

Create hunting rule

PUA.SecuriteInfo.com.JS.Malware-1.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/6327980bf380ad765b53f7b3411471c9069e0ad2a7ec3f247b8a8bd3fc8b6fde/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/63811292559d07a06f477933/reports/4e2e54f3-ac3d-47ba-a3d8-15ce5f3fc0a3/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/6327980bf380ad765b53f7b3411471c9069e0ad2a7ec3f247b8a8bd3fc8b6fde

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6327980bf380ad765b53f7b3411471c9069e0ad2a7ec3f247b8a8bd3fc8b6fde/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mmtzqc7tqcwxmw2t66zucfdrzedj4cwsu7wd6jd3rkf5h7eln7pa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/221125-x297bacf7x/

Behaviour

Modifies system certificate store

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/6327980bf380ad765b53f7b3411471c9069e0ad2a7ec3f247b8a8bd3fc8b6fde