MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 902cbec8e7ada4b95292147a9fa5ffc4867a0d0edad89161535e6d96894bd13e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	902cbec8e7ada4b95292147a9fa5ffc4867a0d0edad89161535e6d96894bd13e
SHA3-384 hash:	ee42b7ded8b9a03d17bd6f8bc35cd334a0946f0cde49421726fee3875d06f2bb3f7baee1037a09d3c6ef61911afcfe0c
SHA1 hash:	96838ceee4372164e2c24ee3657cb4a03ea33912
MD5 hash:	7e98f4cf2680f33cdc26e336d3550466
humanhash:	nitrogen-pip-august-tennessee
File name:	document_F852_Jun_1.zip
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	1'602 bytes
First seen:	2023-06-01 15:00:45 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	48:9jEGoNyx8TqJpB2wFauCWPv5P2mBdIDYFTBf3Z:4NW12Kwkei+sJ1Z
TLSH	T160310CD52C3B0581C37156FF122ADC699F19C594F4216A7B89FD278401C7473DE668C5
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	pr0xylife
Tags:	1685604052 BB30 Qakbot Quakbot zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

145

Origin country :

US

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	document_F852_Jun_1.js
File size:	5'208 bytes
SHA256 hash:	83675c16e4390876135fdfc3296aaadb0d1ebc4dba6d50b6a21bee942a9301eb
MD5 hash:	bc66ce4930a775546bfce9ce22637962
MIME type:	text/plain
Signature	Quakbot

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.25382.ZipHeur.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/902cbec8e7ada4b95292147a9fa5ffc4867a0d0edad89161535e6d96894bd13e/results/dashboard

Payload URLs

URL

File name

C:\\Windows

JS File

Behaviour

BlacklistAPI detected

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6478b2b0b996c26c465e8976/reports/19805dc9-6c62-4b3e-8fca-abe1500e41ea/overview

Hybrid Analysis Mal/DrodZp

Verdict:

Suspicious

Labled as:

Mal/DrodZp

Link:

https://www.hybrid-analysis.com/sample/902cbec8e7ada4b95292147a9fa5ffc4867a0d0edad89161535e6d96894bd13e

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/902cbec8e7ada4b95292147a9fa5ffc4867a0d0edad89161535e6d96894bd13e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/902cbec8e7ada4b95292147a9fa5ffc4867a0d0edad89161535e6d96894bd13e/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-01 15:01:05 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

7 of 24 (29.17%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sawl5shhvwslsuuscr5j7jp7ysdhudio3lmjcyktlzwznckl2e7a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/230601-sjf4aseh93/

Behaviour

Suspicious use of WriteProcessMemory

Blocklisted process makes network request

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.60

Link:

https://yomi.yoroi.company/submissions/902cbec8e7ada4b95292147a9fa5ffc4867a0d0edad89161535e6d96894bd13e