MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b28824450538de61b73dc19df39ee01f1c31eb49634667a1083e0076d800e2e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b28824450538de61b73dc19df39ee01f1c31eb49634667a1083e0076d800e2e2
SHA3-384 hash:	8798617c098d7cd1db4d852e09f79fe3226c8f9b4f5ad3428ac819ae6420c782e916dd4077183d6cbc4b89afe80fd211
SHA1 hash:	65ecc8db26f359208bd5954485a16225e09d1624
MD5 hash:	14d886cfc693e41564549c75547e5012
humanhash:	tango-fillet-juliet-neptune
File name:	gHL9XNnBR0MR.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	296'722 bytes
First seen:	2023-06-15 10:26:34 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb1A9EDB/vGHxhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygH
TLSH	T1D75451996A85F0749033F33BDA1B9804F93B1F1B1194C967B93C5458BF3E418A7B6E88
Reporter	pr0xylife
Tags:	1686813265 BB32 js Qakbot Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

362

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.JS.Agent.USV.24296.13253.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/648ae7789069800b43bc351f/reports/409d0ca8-6b47-42ad-b9de-1fa3ff1c9505/overview

Hybrid Analysis Trojan.JS.Agent

Verdict:

Malicious

Labled as:

Trojan.JS.Agent

Link:

https://www.hybrid-analysis.com/sample/b28824450538de61b73dc19df39ee01f1c31eb49634667a1083e0076d800e2e2

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1255216

Signature

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Very long command line found

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b28824450538de61b73dc19df39ee01f1c31eb49634667a1083e0076d800e2e2/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-15 10:27:08 UTC

File Type:

Text (JavaScript)

AV detection:

4 of 37 (10.81%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wkecirifhdpgdnz5ygo7hhxad4odd22jmndgpiiihyahnwaa4lra._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230615-mg3xdsfh9x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b28824450538/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b28824450538de61b73dc19df39ee01f1c31eb49634667a1083e0076d800e2e2