MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9f52daf168e9d62a485fb63ea53a419d649eb7280d775d4662e0572f62c3318. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FIN7


Vendor detections: 1


Intelligence 1 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9f52daf168e9d62a485fb63ea53a419d649eb7280d775d4662e0572f62c3318
SHA3-384 hash: 26a4fd84ea187591e34d15ed0c5b0caae5ca5bc429e78318f803a592381f360910681ccf16e055f0ffabf2e142347c77
SHA1 hash: 731828ded8ba3d0e9ba21b58620f303efd04846f
MD5 hash: 79e65257425ef04267d1e35fcccd8fb7
humanhash: utah-rugby-virginia-solar
File name:sc.js
Download: download sample
Signature FIN7
Create hunting rule
File size:8'540 bytes
First seen:2021-02-16 17:01:49 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 192:SI1rXmYwb3C+VP3vxDtseR8lHlfAvS/QhDS/hWsMFHtH45NDeT:SI1rXmYwb1VPEeGlHlfAvKQlS/hWlHtZ
TLSH 7B02134367EA420CB1F72B49967715350A3BBE95693EC64D45883C1D0FF3A0848A7BE3
Reporter Arkbird_SOLG
Tags:Clear FIN7 js

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Script.Heuristic-js.iacgm.7093.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f9f52daf168e9d62a485fb63ea53a419d649eb7280d775d4662e0572f62c3318/
Result
Malware family:
n/a
Score:
  8/10
Tags:
evasion trojan
Link:
https://tria.ge/reports/210216-e8cecwqqve/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Control Panel
Modifies Internet Explorer settings
Modifies registry class
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Checks whether UAC is enabled
Deletes itself
Blocklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/f9f52daf168e9d62a485fb63ea53a419d649eb7280d775d4662e0572f62c3318

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FIN7

rar a92b3703e947c39d3f59d4304c201198fe22063a95d339a806ea68dedbbec902

FIN7

Excel file xls a818af0d4996a2120bc81e399b946f86b52fababc8904c49cd4ec1f298dc0199

FIN7

Java Script (JS) js 34218554f4469a6c8c5d68fd6c4c90d6e9789d3bf2935704f81897352b3a1627

FIN7

Java Script (JS) js f9f52daf168e9d62a485fb63ea53a419d649eb7280d775d4662e0572f62c3318

(this sample)

  
Dropped by
SHA256 34218554f4469a6c8c5d68fd6c4c90d6e9789d3bf2935704f81897352b3a1627
  
Delivery method
Other

Comments