MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c4e944ed4aff9e0cbc9144cd4de2c6f7b3dc95f15f8f9063c96019794c96211. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6c4e944ed4aff9e0cbc9144cd4de2c6f7b3dc95f15f8f9063c96019794c96211
SHA3-384 hash:	5b788463a5a256e44d2b53f9af01dfc35876626e3a27d4b9c2d7050790b121c21ad83878455800ee978ba3f83b35cbb5
SHA1 hash:	4fc78548b2a73b9d32934d3a45463c5936aeada7
MD5 hash:	c46470c6757d89cb8df5cbd9e90dfb2d
humanhash:	nevada-beer-seven-batman
File name:	deobfuscated_script.js
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	9'601 bytes
First seen:	2023-09-15 10:39:44 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	192:LdOtNu26v60UXJul/FDbo2XIasVVsv8xnPwhTPHJXEKpX4HUgwjDssF:RhT6X4l/FDs2Yx0PHJ0EKUgeDBF
TLSH	T1C312D8895AF0169D163A223C43DF0B06B5E103330056CF8E544EEAF06DA5D3ADA5F5BC
Reporter	Viuleeenz
Tags:	deobfuscated goamiev-com Gozi js

viuleeenz

Deobfuscated version of https://bazaar.abuse.ch/sample/f3489b0781a345b583a77439f980f65df1194f7effed341dcb9cd7e0a6ef3605/

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

360

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

sload

Link:

https://www.filescan.io/uploads/650434837c054d8c55620042/reports/f89b7061-b853-4669-8f1c-7b902350d4a7/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6c4e944ed4aff9e0cbc9144cd4de2c6f7b3dc95f15f8f9063c96019794c96211

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1308879

Signature

Antivirus detection for URL or domain

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for domain / URL

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6c4e944ed4aff9e0cbc9144cd4de2c6f7b3dc95f15f8f9063c96019794c96211/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nrhjitwuv746bs6jcrgnjxrmn55t3sk7cx4psbr4syazpfgjmiiq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/230915-mqhyksba7v/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.68

Link:

https://yomi.yoroi.company/submissions/6c4e944ed4aff9e0cbc9144cd4de2c6f7b3dc95f15f8f9063c96019794c96211