MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1bf8d22f9b6451e18564e2518ba6f40cb19128c8aaa86713bc4c43e01a2e7fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1bf8d22f9b6451e18564e2518ba6f40cb19128c8aaa86713bc4c43e01a2e7fd
SHA3-384 hash: 1a214961416253c43a764da8f7d4fbc0c4b4566cfc0e7d4c9ae34988d2cb2706fce7950b605dc386c106b312ae2c1004
SHA1 hash: 1b46b88cd9ab1392a710ba12fd462c7d3aa1330a
MD5 hash: 57b8ebd2e0da26baec8e3d58152da406
humanhash: william-oscar-nine-romeo
File name:0548ca75-784c-4df6-b46d-92a328cb1226.js
Download: download sample
File size:3'457'069 bytes
First seen:2024-01-09 04:07:55 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 12288:JrMSHOYxRYmmzR1QPeJ/OeycNzErnSp9BUwn/IFq3bH72JAnK3b2F3ikk0vhvD1y:GTD3klCPwHTFDhoQb
TLSH T1CEF57AF416A06CFADBBD0E2ECC34C96ECAB86D67A74D6087D517FCB5D848B140E06690
Reporter ajmeese7
Tags:crypto javascript js obfuscated phishing


Avatar
ajmeese7
Malicious background script on the phishing URL https://bittrex.omniagentssolution.com/account/?dashboard/ajmeese7@gmail.com/jan/withdraw#refid=BTC/XRP/USDT/ETH/LINK/XMR/BCH/ERC-20/BSC/BNB/stETH, which is posing as the Bittrex cryptocurrency exchange in an attempt to steal the contents of visitor's crypto wallets.

Intelligence

File Origin
# of uploads :
1
# of downloads :
422
Origin country :
US US
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/659cc6a494d1aebfb294ee1b/reports/a23065a2-230a-474b-b41a-482e48e6add5/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/f1bf8d22f9b6451e18564e2518ba6f40cb19128c8aaa86713bc4c43e01a2e7fd
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
1 / 100
Link:
https://www.joesandbox.com/analysis/1371603
Behaviour
Behavior Graph:
n/a
Score:
80%
Verdict:
Malware
File Type:
ASCII
Link:
https://malprob.io/report/f1bf8d22f9b6451e18564e2518ba6f40cb19128c8aaa86713bc4c43e01a2e7fd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f1bf8d22f9b6451e18564e2518ba6f40cb19128c8aaa86713bc4c43e01a2e7fd/
Threat name:
Win32.Trojan.ScarletFlash
Create hunting rule
Status:
Malicious
First seen:
2024-01-09 04:08:08 UTC
File Type:
Text (JavaScript)
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6g7y2ixzwzcr4gcwjysrrotpidfrseumrkvim4j3ytcd4anc476q._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/240109-ep773sehcl/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f1bf8d22f9b6451e18564e2518ba6f40cb19128c8aaa86713bc4c43e01a2e7fd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments