MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e30c2be9295185b257fc75b5050ecf6f90c6e4df293b4bc0abeb3f2955f0afea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e30c2be9295185b257fc75b5050ecf6f90c6e4df293b4bc0abeb3f2955f0afea
SHA3-384 hash:	371d9ced756120bc65b140495e962bf436798385a825130fa89fbe5d39a0c1ec173f717b6ea62d9b61563b05a34e9bda
SHA1 hash:	23c914c69781d0f2cdacbf4770c87fc03d3c5540
MD5 hash:	09f5bbbead93bf3ff846e775bfa47ff1
humanhash:	illinois-saturn-white-queen
File name:	d2NckNLiL6A3DM.js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	363'430 bytes
First seen:	2023-06-14 07:35:44 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRby+GyiKbhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygk
TLSH	T14A7441896655E0F15237F37BCE164420F9AB0E4B1088C976BA3C50596F3D8297EB7EC8
Reporter	JAMESWT_WT
Tags:	js Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

229

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/64896dec2df0889bde9ff531/reports/7ff82830-d644-4e35-bc89-003bdabf8725/overview

Hybrid Analysis JS/Agent.QVM trojan

Verdict:

Suspicious

Labled as:

JS/Agent.QVM trojan

Link:

https://www.hybrid-analysis.com/sample/e30c2be9295185b257fc75b5050ecf6f90c6e4df293b4bc0abeb3f2955f0afea

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e30c2be9295185b257fc75b5050ecf6f90c6e4df293b4bc0abeb3f2955f0afea/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4mgcx2jjkgc3ev74ow2qkdwpn6imnzg7fe5uxqfl5m7ssvpqv7va._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230614-je9elsed34/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e30c2be9295185b257fc75b5050ecf6f90c6e4df293b4bc0abeb3f2955f0afea