MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67a65e547d816ffbf22aa6f4566683c49686c114668c16d033c7741de6c9b117. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	67a65e547d816ffbf22aa6f4566683c49686c114668c16d033c7741de6c9b117
SHA3-384 hash:	43eac3cf6114bd3ad140269f1adef5e6b92f418d3320a18f45b8c99dbfe46d644d4c3ef07142b231438b249e6113530a
SHA1 hash:	3ee5f8abb07040c157ede275471102e252b0fb68
MD5 hash:	812fc592686d2a81b15385bcfeabeefa
humanhash:	oklahoma-yellow-utah-berlin
File name:	812fc592686d2a81b15385bcfeabeefa.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	262'102 bytes
First seen:	2023-05-17 15:42:28 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:ydtVFJxjpafZxzcUqQNXugAj6n/R0WSpeYjpwAuH3Jh0FBBpnJoW+GwovA:yVxtafZ5c4MgAeCWnAuHT1WEovA
TLSH	T1B6447B80479514765B5B7F267734A8B1DABE0D7882889A8BF81F3265B2CF58CCCD8731
TrID	65.2% (.CFC) ColdFusion Component (with rem) (7500/1/1) 34.7% (.S) Digital Micrograph Script (4000/1/1)
Reporter	abuse_ch
Tags:	BB28 js Qakbot qbot Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

402

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Trojan.Cryxos.12636.13300.2752.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive obfuscated powershell wscript

Link:

https://www.filescan.io/uploads/6464f606ca9bd3357900308a/reports/17a4b923-2bcc-4467-856d-e0458bac77c5/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/67a65e547d816ffbf22aa6f4566683c49686c114668c16d033c7741de6c9b117

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/67a65e547d816ffbf22aa6f4566683c49686c114668c16d033c7741de6c9b117/

ReversingLabs TitaniumCloud Script-JS.Trojan.Cryxos

Threat name:

Script-JS.Trojan.Cryxos

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-17 15:43:05 UTC

File Type:

Text (JavaScript)

AV detection:

5 of 37 (13.51%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=m6tf4vd5qfx7x4rku32fmzudyslinqium2gbnubty52b3zwjwelq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230517-s5w2msff47/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/67a65e547d81/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/67a65e547d816ffbf22aa6f4566683c49686c114668c16d033c7741de6c9b117