MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7273b75e139f3dd30809a4e9c1abeec754ee24b0a7f1ccc2333727449802fb81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7273b75e139f3dd30809a4e9c1abeec754ee24b0a7f1ccc2333727449802fb81
SHA3-384 hash:	d66d236fff5dbc70133835beb1d3c8515ada055335f8ecb568176a8ce97e3a088dca2b3c556832e8e000e1ce2ddea212
SHA1 hash:	b2687b0ca75bda395148ab60154337fad930ce5f
MD5 hash:	2130c54b54046fa5bbfbc16c9b573e64
humanhash:	mike-avocado-lamp-may
File name:	QgESjgbpGKkhH.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	342'658 bytes
First seen:	2023-06-14 07:45:54 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbw9wjOTMahS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygB
TLSH	T1967442496A55E0F18237F37BCA168410FAAB1E5B2084C972B97C515C2F3D8297EB7EC4
Reporter	JAMESWT_WT
Tags:	js Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

290

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.HEUR.Trojan-Downloader.Script.Agent.gen.29369.13260.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6489704642386ee977f41cc5/reports/8996700a-9f54-4b98-9612-f53514eee312/overview

Hybrid Analysis JS/Agent.QVM trojan

Verdict:

Suspicious

Labled as:

JS/Agent.QVM trojan

Link:

https://www.hybrid-analysis.com/sample/7273b75e139f3dd30809a4e9c1abeec754ee24b0a7f1ccc2333727449802fb81

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7273b75e139f3dd30809a4e9c1abeec754ee24b0a7f1ccc2333727449802fb81/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-14 06:29:15 UTC

File Type:

Text (HTML)

AV detection:

5 of 24 (20.83%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ojz3oxqtt465gcajutu4dk7oy5ko4jfqu7y4zqrtg4tujgac7oaq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230614-jlz5hsee86/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7273b75e139f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7273b75e139f3dd30809a4e9c1abeec754ee24b0a7f1ccc2333727449802fb81