MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8dc02c4a8a3c64d88bff8258ba7773c1d6032ed362264332d5bcfb1625fa618f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8dc02c4a8a3c64d88bff8258ba7773c1d6032ed362264332d5bcfb1625fa618f
SHA3-384 hash:	f374643e938c86c1ef75fab9ef72cc2257af4ebf330eb8e2b693c1677deaa7d4dda4c1a7808cbcfd4499897d0344eec1
SHA1 hash:	54b5a11a89668c15cfa51fe5cd6855a82cddb777
MD5 hash:	a9b5e854ec2d7322ae5b33eb6b327e67
humanhash:	carolina-speaker-butter-quebec
File name:	documento1.js
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	35'960 bytes
First seen:	2023-03-23 14:17:23 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:zRfEXHHPyUJqKG1VaHqS9YLoHvtPis7fid2zy:zRfEXHHrzKH+q2zy
TLSH	T166F29FFC877A27300DEB9A6B10D2B970CB9D9C658694543618F06EA359103BB4D6BCF2
Reporter	JAMESWT_WT
Tags:	EUROSPURGHI Gozi js js2 Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

267

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

nemucod powercat sload virus

Link:

https://www.filescan.io/uploads/641c5f9f80ca4ca1ff58a507/reports/aed86586-79f6-4b7c-9a12-e18a14c1e0c5/overview

Hybrid Analysis Trojan.Script.ExpKit

Verdict:

Malicious

Labled as:

Trojan.Script.ExpKit

Link:

https://www.hybrid-analysis.com/sample/8dc02c4a8a3c64d88bff8258ba7773c1d6032ed362264332d5bcfb1625fa618f

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1200667

Signature

Multi AV Scanner detection for domain / URL

Sample has a suspicious name (potential lure to open the executable)

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8dc02c4a8a3c64d88bff8258ba7773c1d6032ed362264332d5bcfb1625fa618f/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rxacysukhrsnrc77qjmlu53tyhlaglwtmitegmwvxt5rmjp2mghq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/230323-rl99gsaa9y/

Behaviour

Modifies system certificate store

Blocklisted process makes network request

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.