MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc4f6ec711e68a0e711819a0b73c1195b8ea7696cade564039c3b762eaa6dd0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fc4f6ec711e68a0e711819a0b73c1195b8ea7696cade564039c3b762eaa6dd0d
SHA3-384 hash:	6aba764879d0368f5d6e63900150c8181a3ddedf404fc61eb5296bb23486bfa01a83b6a99199557a0b6fb9756ae594ca
SHA1 hash:	c3db0c4a00a113a45682fe073ea2d25c8929cc44
MD5 hash:	55e5f066b2cd40758453a631c146ec01
humanhash:	jersey-three-pizza-princess
File name:	f96FThhlL9LZ6Y.js
Download:	download sample
File size:	333'018 bytes
First seen:	2023-06-14 07:34:44 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbYjsur9zw+UB5GYLWzRhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygz
TLSH	T1116432895A41E0F09237B33BDE579410FAAB1E5B10C48972B93C51581F3D8697EBBEC8
Reporter	JAMESWT_WT
Tags:	js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

215

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/64896db02df0889bde9ff520/reports/eb099400-2ebe-4ced-979b-c1967e458eee/overview

Hybrid Analysis Trojan.Cryxos.JS

Verdict:

Malicious

Labled as:

Trojan.Cryxos.JS

Link:

https://www.hybrid-analysis.com/sample/fc4f6ec711e68a0e711819a0b73c1195b8ea7696cade564039c3b762eaa6dd0d

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1254463

Signature

Encrypted powershell cmdline option found

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Very long command line found

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fc4f6ec711e68a0e711819a0b73c1195b8ea7696cade564039c3b762eaa6dd0d/

ReversingLabs TitaniumCloud Script-JS.Trojan.Cryxos

Threat name:

Script-JS.Trojan.Cryxos

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-13 19:34:25 UTC

File Type:

Text (HTML)

AV detection:

3 of 37 (8.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7rhw5ryr42fa44iydgqloparsw4ou5uwzlpfmqbzyo3wf2vg3ugq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230614-jen4nsed24/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fc4f6ec711e68a0e711819a0b73c1195b8ea7696cade564039c3b762eaa6dd0d