MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73255d0f55d8114a9ad63fe3bd964b66a5495b57364dbe586eb88191d8b96d6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	73255d0f55d8114a9ad63fe3bd964b66a5495b57364dbe586eb88191d8b96d6b
SHA3-384 hash:	3aa2ba1136c9e01720c739be8dcc56b6fc6d25ac82c715e8fcb73e70bcccd8d30d424bb84b4202d5b29d4068f4f74314
SHA1 hash:	9546ef22912d86e31267f2a5d8400a0ebc531901
MD5 hash:	6778c3c404573d5088b18d8e2918de2d
humanhash:	spring-music-louisiana-october
File name:	TKsZ61VHW1Qmlk.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	353'389 bytes
First seen:	2023-06-14 07:43:06 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbVYl9Fw/QxB0hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygI
TLSH	T1C5743145AA55E4F08337B33BDA178010FAAB4E5B1084D962B93C50586F3D86D7EB7EC8
Reporter	JAMESWT_WT
Tags:	js Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

288

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Trojan.Cryxos.12665.24275.25958.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/64896fc32df0889bde9ff5de/reports/adb5f11b-9928-4e91-82df-fb40a868a762/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/73255d0f55d8114a9ad63fe3bd964b66a5495b57364dbe586eb88191d8b96d6b

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/73255d0f55d8114a9ad63fe3bd964b66a5495b57364dbe586eb88191d8b96d6b/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-13 21:26:59 UTC

File Type:

Text (JavaScript)

AV detection:

4 of 37 (10.81%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=omsv2d2v3aiuvgwwh7r33fslm2susw2xgzg34wdoxcazdwfznvvq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230614-jkbqjaee57/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/73255d0f55d8/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/73255d0f55d8114a9ad63fe3bd964b66a5495b57364dbe586eb88191d8b96d6b