MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90fb5559322b1ff47e350bb5f35a3a9f8d003160c47c9d4a86a121d8c2f708e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	90fb5559322b1ff47e350bb5f35a3a9f8d003160c47c9d4a86a121d8c2f708e4
SHA3-384 hash:	0be452f8b1a9f6e6a438737288b79f14a71f42fb8bf5f3de6ae4c41ca3abb187cd664298d3da7055303959ea254bcf51
SHA1 hash:	cf8613a6ef01e992ed1e27d1089a8e46c7916460
MD5 hash:	5c69c714fd8677a8fc5165a2cf73df73
humanhash:	muppet-wolfram-princess-april
File name:	SCotO65yEowD1s.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	333'972 bytes
First seen:	2023-06-14 07:44:49 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbAEv/UrI2bxpUEKSxAIEwcQP:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg4
TLSH	T1B06442496A86E0F18237F37BCA178414F96B1F5B10848932B97C55582F3D8297EB7EC8
Reporter	JAMESWT_WT
Tags:	js Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

290

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6489700b42386ee977f41c92/reports/ea63460b-d3ba-4cd3-906a-1b013bdea699/overview

Hybrid Analysis JS/Agent.QVM trojan

Verdict:

Suspicious

Labled as:

JS/Agent.QVM trojan

Link:

https://www.hybrid-analysis.com/sample/90fb5559322b1ff47e350bb5f35a3a9f8d003160c47c9d4a86a121d8c2f708e4

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/90fb5559322b1ff47e350bb5f35a3a9f8d003160c47c9d4a86a121d8c2f708e4/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sd5vkwjsfmp7i7rvbo27gwr2t6gqamlayr6j2sugueq5rqxxbdsa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230614-jlfqwaeg2w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/90fb5559322b1ff47e350bb5f35a3a9f8d003160c47c9d4a86a121d8c2f708e4