MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5c40040c76e177f3ff8104c1846ad28c3b2e474491f8e569925807d189959bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b5c40040c76e177f3ff8104c1846ad28c3b2e474491f8e569925807d189959bb
SHA3-384 hash:	639afbd109fa858cb5659d7b48b71b71400238203d808d8e0ad10ea200fb729cb5e217f9d2b87aea17310ed4b7c803f0
SHA1 hash:	0b537776848135626daadc622e14b435a3ba7d76
MD5 hash:	b5e7d3ef3ae2ecdd904998285c2bd3bd
humanhash:	virginia-equal-kansas-carpet
File name:	ds3U0T5ga7kXT1.js
Download:	download sample
File size:	326'153 bytes
First seen:	2023-06-14 07:35:35 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbfRNSDXWsuhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg+
TLSH	T1816433496645E0F59137F33BDA578410FAAB0F1B20848932B97C50586F3D869AFB7EC8
Reporter	JAMESWT_WT
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

220

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/64896de92df0889bde9ff52f/reports/26860dff-c409-42b1-aea5-5106e10132bd/overview

Hybrid Analysis JS/Agent.QVM trojan

Verdict:

Suspicious

Labled as:

JS/Agent.QVM trojan

Link:

https://www.hybrid-analysis.com/sample/b5c40040c76e177f3ff8104c1846ad28c3b2e474491f8e569925807d189959bb

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1254281

Signature

Encrypted powershell cmdline option found

JScript performs obfuscated calls to suspicious functions

Very long command line found

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b5c40040c76e177f3ff8104c1846ad28c3b2e474491f8e569925807d189959bb/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wxcaaqghnylx6p7ycbgbqrvnfdb3fzdujepy4vuzewah2gezlg5q._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230614-je84vaed32/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b5c40040c76e177f3ff8104c1846ad28c3b2e474491f8e569925807d189959bb