MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73bc302906aef2544f8508fea3b9fa2e0a148ee4466872ba9e74ef23978c80bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	73bc302906aef2544f8508fea3b9fa2e0a148ee4466872ba9e74ef23978c80bb
SHA3-384 hash:	06fee3e7ba37fba6faff045863c43672a5cdbd4844a0d537b690ea4e9092e946929d05842d23100eeefd07b49d818e27
SHA1 hash:	a8d31bd54f70951b8dc61695d357f36d3fd23397
MD5 hash:	70e2098acfdc24f9812ce9abe9d5ba86
humanhash:	table-west-montana-apart
File name:	1_IT0_05_25_2023_01_21314.js
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	41'149 bytes
First seen:	2023-05-25 16:50:11 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:Yn4dQJxwT4mBPKY7QZqDXSTKL0gskkYiDQBymAc7X7:YnbxAxBiSxDXEKL0//YymAu7
TLSH	T10803A5CE3F81F8309762A477AA4FE0E9ED1E6C51658841EEF625BC54F5E821DE233418
Reporter	JAMESWT_WT
Tags:	agenziaentrate Gozi isfb js Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

352

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

nemucod powercat virus

Link:

https://www.filescan.io/uploads/646f91f63a39de578e9fa12f/reports/44488043-fc7d-4ea5-bb69-d1d1e4f1f8b9/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/73bc302906aef2544f8508fea3b9fa2e0a148ee4466872ba9e74ef23978c80bb

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1242641

Signature

JavaScript source code contains call to eval() to check own source code (likely for evading instrumentation)

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

JScript performs obfuscated calls to suspicious functions

Potential obfuscated javascript found

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/73bc302906aef2544f8508fea3b9fa2e0a148ee4466872ba9e74ef23978c80bb/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oo6dakigv3zfit4fbd7khop2fyfbjdxeizuhfou6otxshf4mqc5q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230525-vcsvmaca3t/

Behaviour

Script User-Agent

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.38

Link:

https://yomi.yoroi.company/submissions/73bc302906aef2544f8508fea3b9fa2e0a148ee4466872ba9e74ef23978c80bb