MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5799679892f2d41682602153ef3a6cb8606cc55b642e23e1d0074acdebf324f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d5799679892f2d41682602153ef3a6cb8606cc55b642e23e1d0074acdebf324f
SHA3-384 hash:	f005e1f045d4e1e38e2b728094370912e95bf44a5195de498b49611abcd926f7fd1240ec5a2352719b5a6a34628e1a56
SHA1 hash:	55b4e35a2ebee7d84ec0c5085c72e9f8a04ad7a7
MD5 hash:	ffdd959d455d516f841102d5f0ef474d
humanhash:	michigan-wolfram-delaware-tango
File name:	W2I4jd9Ysv5XC9.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	348'019 bytes
First seen:	2023-06-14 07:40:13 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb93d8IZA7OhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygi
TLSH	T14E7455856645E0F18237B33BDE175010FAAB1E5B20C48972B93C51586F3D8697EBBEC8
Reporter	JAMESWT_WT
Tags:	js Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

288

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/64896f1242386ee977f41bd5/reports/61bb995d-311e-4f13-b3a3-08f010cacf33/overview

Hybrid Analysis JS/Agent.QVM trojan

Verdict:

Suspicious

Labled as:

JS/Agent.QVM trojan

Link:

https://www.hybrid-analysis.com/sample/d5799679892f2d41682602153ef3a6cb8606cc55b642e23e1d0074acdebf324f

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d5799679892f2d41682602153ef3a6cb8606cc55b642e23e1d0074acdebf324f/

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2v4zm6mjf4wuc2bgaikt545gzodantcvwzboepq5ab2kzxv7gjhq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230614-jh57csee28/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d5799679892f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d5799679892f2d41682602153ef3a6cb8606cc55b642e23e1d0074acdebf324f