MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f929428a217ff296d65c32306eda42ed9b315bdbcb403bfcdfa02f897dbf926. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8f929428a217ff296d65c32306eda42ed9b315bdbcb403bfcdfa02f897dbf926
SHA3-384 hash:	207ea3c12fefcc9940a8149a7fb1e50106192a929cf353f9fd42429a225c52bb5e6a4cf9b2f4de6db494ec144dd5cf1a
SHA1 hash:	778a5678cec8d79e61019a9cc7f68a72ea49103e
MD5 hash:	22eee5284f2009bf4e42338f3de7fde3
humanhash:	seven-michigan-lamp-hot
File name:	YtLn6Ctai99v.js
Download:	download sample
File size:	356'318 bytes
First seen:	2023-06-14 07:39:02 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb0U4+N61AilghS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg4
TLSH	T1277441886655E0F19137B33BCA068420FA6B1E5B2084C972B97C515D2F3D85D7EFBE88
Reporter	JAMESWT_WT
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

263

Origin country :

IT

Vendor Threat Intelligence

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8f929428a217ff296d65c32306eda42ed9b315bdbcb403bfcdfa02f897dbf926

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1254268

Signature

Encrypted powershell cmdline option found

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Very long command line found

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8f929428a217ff296d65c32306eda42ed9b315bdbcb403bfcdfa02f897dbf926/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r6jjikfcc77ss3lfymrqn3nef3m3gfn5xs2ahp6n7ibprf637eta._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230614-jg1kgsef3x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8f929428a217/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8f929428a217ff296d65c32306eda42ed9b315bdbcb403bfcdfa02f897dbf926