🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90ad0419ae1b26319928f9ecccf5bfa159529c6d20f498ba79d4e6c3423797f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90ad0419ae1b26319928f9ecccf5bfa159529c6d20f498ba79d4e6c3423797f7
SHA3-384 hash: 2102aa7ad946bb8929bc88c6ed1712ffd6b035d7ea39a2f3896c83ff54980d0edf2d299edfb15973a93207c021538984
SHA1 hash: 2cd8cab8507dfe047f747c99b21c8cc1296d4865
MD5 hash: f15286be6311602198ac7f075b134447
humanhash: mango-march-aspen-nitrogen
File name:2021APT-28_75912453.js
Download: download sample
Signature TrickBot
Create hunting rule
File size:101'979 bytes
First seen:2021-07-29 05:13:57 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 3072:59Ry98guHVBqqg2bcruzUHmLKeMMU7GwbWBPwVGWl9SZ8kV8Gd5bzIvt/4g5eaX1:59Ry9RuXqW4SzUHmLKeMMU7GwWBPwVGq
TLSH T1D3A360D86BD0E417338D2F1BFE0A3AEAD17A685796C47507D1583A5C28ED21BC6A0CF4
Reporter cocaman
Tags:js TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
435
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Agent.AXV1Eldorado.26622.22881.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script.Downloader.SLoad
Create hunting rule
Status:
Malicious
First seen:
2021-07-29 05:14:16 UTC
File Type:
Text (JavaScript)
AV detection:
3 of 46 (6.52%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=scwqignodmtddgji7hwmz5n7ufmvfhdned2jrotz2ttmgqrxs73q._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/210729-2c59yn9ls2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Blocklisted process makes network request
Malware Config
Dropper Extraction:
http://smart-integrator.hr/pornhub.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/90ad0419ae1b26319928f9ecccf5bfa159529c6d20f498ba79d4e6c3423797f7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

zip 61ab623bd589024bfe62a915679ce996afa523217bca7e814ceb61bc77250f3c

TrickBot

Java Script (JS) js 90ad0419ae1b26319928f9ecccf5bfa159529c6d20f498ba79d4e6c3423797f7

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 61ab623bd589024bfe62a915679ce996afa523217bca7e814ceb61bc77250f3c

Comments