MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd82aabebd4b206d46ba0d6f3cbdcb9ea620086dba75851c03fd618a3c96b439. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fd82aabebd4b206d46ba0d6f3cbdcb9ea620086dba75851c03fd618a3c96b439
SHA3-384 hash:	537ac9ac59ae981c0c87c1dd2692d2097865bb64c264ac414afa93f195c6081466cc4fb8af69ea8096c535b70d25c878
SHA1 hash:	15169635aa7e7cf51b8dcc162ee905f61e71edfd
MD5 hash:	2bc8f06b2904d42bd14dc333b69e4c9b
humanhash:	spaghetti-florida-quebec-delta
File name:	Document #33088.DOCX .js
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	117'416 bytes
First seen:	2023-03-02 18:40:38 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:jW930DchmpEjNJkJJFRCd3NMJ1oYfJnyUMsFr9ZXyOjVlNEuyK3kY7cbeGCyLEFm:jWRr0i
TLSH	T1FEB3344C7ED7A808623EB27F630B9D14E1150B6705491A5B783DE538EFF2214BB92DB8
Reporter	k3dg3___
Tags:	BB17 js qbot Quakbot ta577

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

309

Origin country :

US

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated rundll32.exe

Link:

https://www.filescan.io/uploads/6400edbf66e79c93ba0d74fc/reports/20c264fd-defd-4044-a3f0-5e7c4b74e164/overview

Hybrid Analysis SVM:TrojanDownloader/JS.Nemucod

Verdict:

Suspicious

Labled as:

SVM:TrojanDownloader/JS.Nemucod

Link:

https://www.hybrid-analysis.com/sample/fd82aabebd4b206d46ba0d6f3cbdcb9ea620086dba75851c03fd618a3c96b439

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

bank.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1186039

Signature

Downloads files with wrong headers with respect to MIME Content-Type

Encrypted powershell cmdline option found

JavaScript source code contains functionality to generate code involving a shell, file or stream

JScript performs obfuscated calls to suspicious functions

Malicious encrypted Powershell command line found

Maps a DLL or memory area into another process

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Powershell drops PE file

Sample has a suspicious name (potential lure to open the executable)

Uses an obfuscated file name to hide its real file extension (double extension)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fd82aabebd4b206d46ba0d6f3cbdcb9ea620086dba75851c03fd618a3c96b439/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7wbkvpv5jmqg2rv2bvxtzpolt2tcacdnxj2ykhad7vqyupewwq4q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/230302-xbrbhsec32/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

Malware Config

Dropper Extraction:

http://138.197.74.198/eRV/020
http://157.245.254.227/EMs6DTE/020
http://143.244.147.175/3r7w/020

VMRay QBot

Malware family:

QBot

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fd82aabebd4b/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fd82aabebd4b206d46ba0d6f3cbdcb9ea620086dba75851c03fd618a3c96b439