MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83675c16e4390876135fdfc3296aaadb0d1ebc4dba6d50b6a21bee942a9301eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	83675c16e4390876135fdfc3296aaadb0d1ebc4dba6d50b6a21bee942a9301eb
SHA3-384 hash:	d8cbc9d3d9aa0a2cbe6894223431681ad05ba8f590f5bba6907b4c0dfadb4ed09433cf510b67cdf52b35fb3f038804c0
SHA1 hash:	fc9ecfad27e5ce393501a96cd81ae5af47e0bc58
MD5 hash:	bc66ce4930a775546bfce9ce22637962
humanhash:	august-illinois-stairway-mockingbird
File name:	document_F852_Jun_1.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	5'208 bytes
First seen:	2023-06-01 15:00:50 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	96:XbW9YIOIop2JPBBDbyL5fsgBhBFBpFBiNBBPiZ1Fmf0T3eaf:RI22JGpIiZ+wuU
TLSH	T181B1F07B9F5D8EBED269FD141084AD0FD2C5C636221F6C93F74A44A174EE81982BB8C4
Reporter	pr0xylife
Tags:	1685604052 BB30 js Qakbot Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

306

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Backdoor.JS.QBot.602.19416.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

nemucod powercat virus

Link:

https://www.filescan.io/uploads/6478b2b1df3993fe48aa2db8/reports/5e5edd4c-f8c3-4c33-8f57-333288334414/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/83675c16e4390876135fdfc3296aaadb0d1ebc4dba6d50b6a21bee942a9301eb

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/83675c16e4390876135fdfc3296aaadb0d1ebc4dba6d50b6a21bee942a9301eb/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-01 15:01:05 UTC

File Type:

Text (JavaScript)

AV detection:

5 of 37 (13.51%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qntvyfxeheehme2737bss2vk3mgr5pcnxjwvbnvcdpxjikutahvq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/230601-sdwlsseh49/

Behaviour

Suspicious use of WriteProcessMemory

Blocklisted process makes network request

Process spawned unexpected child process

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/83675c16e439/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/83675c16e4390876135fdfc3296aaadb0d1ebc4dba6d50b6a21bee942a9301eb