MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be02f07ff6688aed5d996b27ae28ce4c7c97311faf80eddab4b15d22ab72eb80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	be02f07ff6688aed5d996b27ae28ce4c7c97311faf80eddab4b15d22ab72eb80
SHA3-384 hash:	b6184de6ffcfb1ed3ea9c4f55ddb209e5ed782430351f1702c3838e8a5480e04c7c140e05087a28865fb3840f985ce3c
SHA1 hash:	1c294464fdf5a1f420c045a6dcd995ab471dbce1
MD5 hash:	cc4dab88b91c64f6ae12956bac0f2929
humanhash:	skylark-mirror-texas-six
File name:	lista.js
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	47'194 bytes
First seen:	2023-04-28 06:34:14 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:bVBUBeBeBeBeBeB8SbKj8KwCH2fLnhXanhXanhXanhXgoD2Go5OF5OQ5OE5O35O5:bVG888882eKj8Kh2fdXIXIXIXLyGo5OB
TLSH	T1A223C09B47948BF9DC2317E808629AECD1715BC574CDCCF18E78CD0B9794538A291B8E
Reporter	JAMESWT_WT
Tags:	DhlCredit Gozi js js2 Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

293

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated regsvr32

Link:

https://www.filescan.io/uploads/644b6918961a21dc785bc1f4/reports/93203d38-cc48-44ce-b8d1-febb5d97a0a4/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/be02f07ff6688aed5d996b27ae28ce4c7c97311faf80eddab4b15d22ab72eb80

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1222620

Signature

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/be02f07ff6688aed5d996b27ae28ce4c7c97311faf80eddab4b15d22ab72eb80/

ReversingLabs TitaniumCloud Script-JS.Trojan.Ursnif

Threat name:

Script-JS.Trojan.Ursnif

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-04-27 11:38:56 UTC

File Type:

Text

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xybpa77wncfo2xmznmt24kgojr6jomi7v6ao3wvuwfosfk3s5oaa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230428-hcb6naec4x/

Behaviour

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.