MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbbc29510831726c62aa9536660b98f97da422d90d68db61c419967b0d32994d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cbbc29510831726c62aa9536660b98f97da422d90d68db61c419967b0d32994d
SHA3-384 hash:	27de5cbc3f35246888d108205a570c634ad9568c0416e9e2c319a6470ac1896f7f82e6bc2be8faae17a7112360376cf3
SHA1 hash:	1f129ec422dc7b3cb805fc7d6f18102be0c19d5e
MD5 hash:	6affafbee411524d38e915d9c56a459a
humanhash:	cola-island-yellow-tennessee
File name:	doc3562701.js
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	35'480 bytes
First seen:	2023-05-17 09:02:19 UTC
Last seen:	2023-05-17 09:55:15 UTC
File type:	js
MIME type:	text/plain
ssdeep	384:MngClKgLRiEqcU8/XIM6xSqJyoPq0sNaClM05+KzgQq7Ipi86BQVI7lYI0J3BdsV:8gWL//rzZvV2Y9PsShnHa0eF
TLSH	T135F2BD9C25C2B013975FF03B729EDCD1DA6A59911BC1280FB81C6274FF95C2CCAA6768
Reporter	lowmal3
Tags:	blahadfurtik-com blahadfurtik2-com js NetSupport

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

266

Origin country :

DE

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd evasive obfuscated powershell

Link:

https://www.filescan.io/uploads/646498474b2025ea496cd372/reports/aeaf06c7-8c20-44b0-b826-7a9d4a615a5c/overview

Hybrid Analysis JS/Kryptik.CMX trojan

Verdict:

Malicious

Labled as:

JS/Kryptik.CMX trojan

Link:

https://www.hybrid-analysis.com/sample/cbbc29510831726c62aa9536660b98f97da422d90d68db61c419967b0d32994d

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

bank.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1235271

Signature

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

JavaScript source code contains call to eval() to check own source code (likely for evading instrumentation)

JavaScript source code contains functionality to generate code involving a shell, file or stream

JScript performs obfuscated calls to suspicious functions

Malicious encrypted Powershell command line found

Multi AV Scanner detection for submitted file

PowerShell case anomaly found

Suspicious powershell command line found

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cbbc29510831726c62aa9536660b98f97da422d90d68db61c419967b0d32994d/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zo6csuiigfzgyyvksu3gmc4y7f62iiwzbvunwyoedglhwdjstfgq._file

Hatching Triage netsupport

Result

Malware family:

netsupport

Alert

Create hunting rule

Score:

  10/10

Tags:

family:netsupport persistence rat

Link:

https://tria.ge/reports/230517-kz1hwaed63/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

NetSupport

Malware Config

Dropper Extraction:

https://www.belllaemonella.it/info/f2.ps1
https://itsupportadminguy.info/itsurjia/homeps.php

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cbbc29510831/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.