MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8c96cc06b2725f233673141c1302ffe18ec461d4367a388057cd8e63fb6cbde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f8c96cc06b2725f233673141c1302ffe18ec461d4367a388057cd8e63fb6cbde
SHA3-384 hash:	4393f2133c7a24f09798d03ed8ea9300727bc8b218714b11aae89b933665b93130187a11c41ae7eb719b9680e346ea89
SHA1 hash:	d12c3d88d97690262680094e40c760178dfdca51
MD5 hash:	3633881371f93ace2b849769bf1a21ac
humanhash:	apart-alpha-nuts-tennessee
File name:	g7oMUPzhllj4.js
Download:	download sample
File size:	339'387 bytes
First seen:	2023-06-14 06:59:52 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbdFOtLMjyp0hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygG
TLSH	T10B7442896A55F0F19237B33BDA174410F96B0E5B2084C972BA7C505D2F3D8297AB7EC8
Reporter	JAMESWT_WT
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

254

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Trojan.Cryxos.12665.25079.14058.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/64896593c8878d4c000f30b9/reports/83cbc210-f628-41d0-bc5a-c188bcba58ee/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/f8c96cc06b2725f233673141c1302ffe18ec461d4367a388057cd8e63fb6cbde

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1254473

Signature

Encrypted powershell cmdline option found

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Very long command line found

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f8c96cc06b2725f233673141c1302ffe18ec461d4367a388057cd8e63fb6cbde/

ReversingLabs TitaniumCloud Script-JS.Trojan.Cryxos

Threat name:

Script-JS.Trojan.Cryxos

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-14 06:44:26 UTC

File Type:

Text (HTML)

AV detection:

3 of 37 (8.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7dewzqdle4s7em3hgfa4cmbp7ymoyrq5int2hcafptmomp5wzppa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230614-hspfxseb3s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f8c96cc06b27/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f8c96cc06b2725f233673141c1302ffe18ec461d4367a388057cd8e63fb6cbde