MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed9ca50c6af0648ad70cf3baff98ae9ef635b612cb91dd5f3e4d6810a986698e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ed9ca50c6af0648ad70cf3baff98ae9ef635b612cb91dd5f3e4d6810a986698e
SHA3-384 hash:	7b2c64742b9444af8462dc005dde4a8ac50715d1b2b554ea93671e57ab458ecbe9b72950e044a9d53ef123b6371ec017
SHA1 hash:	c06f2114fd89b7bbc220c8b0f400aaeb28625a18
MD5 hash:	1a790cb271b4c83d2afa9dae23a753a4
humanhash:	paris-sierra-salami-seventeen
File name:	Enquiry_-_Dubai.js
Download:	download sample
File size:	18'714 bytes
First seen:	2024-06-26 13:54:52 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	384:v+CkKceUNhwPhGvkjns+61xY6ayxTZoKxOtELgxpZ25Ex+EMIEzRE7ME9Jt6qpz+:WDhwPhGcjj6U69hIZz95z+
TLSH	T1E182E41135EB714CE2F22FA766FA51E94F6BB9627639512D704C130B0BA3A80CE51B73
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Reporter	JAMESWT_WT
Tags:	0bj3ctivity js Spam-ITA

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

325

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.9051.5438.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=667c1df67d0e07b08a4737f2win10vpnfull_triage

Tags:

Encryption Execution Infostealer Network Stealth

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/667c1dbeef9fdf64aa6f59a2/reports/891ededd-e2b5-488f-a92e-9735b84a3c91/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ed9ca50c6af0648ad70cf3baff98ae9ef635b612cb91dd5f3e4d6810a986698e

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox PXRECVOWEIWOEI Stealer

Result

Threat name:

PXRECVOWEIWOEI Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1463029

Signature

Bypasses PowerShell execution policy

Check if machine is in data center or colocation facility

Connects to a pastebin service (likely for C&C)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Capture Wi-Fi password

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Powershell download and load assembly

Sigma detected: Powershell download payload from hardcoded c2 list

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal WLAN passwords

Tries to steal Mail credentials (via file / registry access)

Uses netsh to modify the Windows network and firewall settings

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected PXRECVOWEIWOEI Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ed9ca50c6af0648ad70cf3baff98ae9ef635b612cb91dd5f3e4d6810a986698e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ed9ca50c6af0648ad70cf3baff98ae9ef635b612cb91dd5f3e4d6810a986698e/

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-06-24 07:42:56 UTC

File Type:

Text (JavaScript)

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5wokkddk6bsivvym6o5p7gfot33dlnqszoi52xz6jvubbkmgngha._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection execution persistence privilege_escalation

Link:

https://tria.ge/reports/240626-q74hdsxemc/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ed9ca50c6af0648ad70cf3baff98ae9ef635b612cb91dd5f3e4d6810a986698e