MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc4bceea65f3abf7437828598325cb027e5b9bd5d33edc8b2371e82a4ac68102. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dc4bceea65f3abf7437828598325cb027e5b9bd5d33edc8b2371e82a4ac68102
SHA3-384 hash:	cc1511fdab4ad60877b17d12f9714dd0ee16513eff447502e3aa73d81a30930a95e25aa16765e842c589fdc34e462984
SHA1 hash:	76ee4117b1d0406fa08d52f7c10d7a0b6dae90c3
MD5 hash:	a1e4b0f98ef03432bfe90e5086e4ab72
humanhash:	lima-charlie-speaker-november
File name:	doc_B285_May_31.zip
Download:	download sample
Signature	NetSupport Alert Create hunting rule
File size:	1'446 bytes
First seen:	2023-05-31 16:32:03 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	24:9PMB3jEEuqsAsrr4fOoW5fDjJdI8yyMl9u7QbU7U77qDkxhquIAE:9PMB4Euqs/rrSOoWFJ28ydl9zkU728q5
TLSH	T1833196EE98AF4295D6BACF36044A0D6234BCB38B47495E2240363684985DA0F0B67519
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	pr0xylife
Tags:	1685526716 BB30 NetSupport Qakbot zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

171

Origin country :

US

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	doc_B285_May_31.js
File size:	4'911 bytes
SHA256 hash:	2e49ac29cdf21a3db8a06c0a338a5fde07bf2569b2dae19af36180e9f2355142
MD5 hash:	61af7475b436f4c65ce250e9eac0d0cc
MIME type:	text/plain
Signature	NetSupport

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/dc4bceea65f3abf7437828598325cb027e5b9bd5d33edc8b2371e82a4ac68102/results/dashboard

Payload URLs

URL

File name

C:\\Windows

JS File

Behaviour

BlacklistAPI detected

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

nemucod powercat virus

Link:

https://www.filescan.io/uploads/647776bfe6cc9218e8eb9467/reports/2b627442-2cf0-4521-8bd1-d62a8f8a662b/overview

Hybrid Analysis Mal/DrodZp

Verdict:

Suspicious

Labled as:

Mal/DrodZp

Link:

https://www.hybrid-analysis.com/sample/dc4bceea65f3abf7437828598325cb027e5b9bd5d33edc8b2371e82a4ac68102

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/dc4bceea65f3abf7437828598325cb027e5b9bd5d33edc8b2371e82a4ac68102

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dc4bceea65f3abf7437828598325cb027e5b9bd5d33edc8b2371e82a4ac68102/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-05-31 16:33:05 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

6 of 37 (16.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3rf452tf6ov7oq3yfbmygjolaj7fxg6v2m7nzczdohucuswgqeba._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.60

Link:

https://yomi.yoroi.company/submissions/dc4bceea65f3abf7437828598325cb027e5b9bd5d33edc8b2371e82a4ac68102