MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a27ee0afb7e14f44621eb09343a0fdc4d9279cb13f27da7ce922a6b60fa3f8da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a27ee0afb7e14f44621eb09343a0fdc4d9279cb13f27da7ce922a6b60fa3f8da
SHA3-384 hash:	0023814d9e02fc32e405c4fb27c1a070b3afb73889839731c45bfece18f86adac939bda168f6983c940bec9abeda343e
SHA1 hash:	209403ffd18fe454642f8ce2de2a439d90893639
MD5 hash:	6aae505f9f3a5d0fffc1432a3fc01837
humanhash:	solar-maryland-july-golf
File name:	cOV95az7WQdHH.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	323'004 bytes
First seen:	2023-06-15 04:03:20 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbRRLtopdLoIBGUbhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygf
TLSH	T1AC6464996D45F0708133B33BDA179450FA3B0F1B2194C966B87C6478BF3D429A6B7E88
Reporter	JAMESWT_WT
Tags:	js Qakbot Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

342

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Script.GenericKDZ.24097.26724.24858.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/648a8db290acee489f78b15a/reports/14187eee-64c2-496b-96e5-e7a6d39e6829/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/a27ee0afb7e14f44621eb09343a0fdc4d9279cb13f27da7ce922a6b60fa3f8da

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1255014

Signature

Encrypted powershell cmdline option found

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Very long command line found

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a27ee0afb7e14f44621eb09343a0fdc4d9279cb13f27da7ce922a6b60fa3f8da/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-14 22:45:01 UTC

File Type:

Text (HTML)

AV detection:

4 of 37 (10.81%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uj7obl5x4fhuiyq6wcjuhih5ytmsphfrh4t5u7hjektlmd5d7dna._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230615-emxnkaee75/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a27ee0afb7e1/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a27ee0afb7e14f44621eb09343a0fdc4d9279cb13f27da7ce922a6b60fa3f8da