MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 262e636e1017d908369407ee3bfa69bde9201e2c98c20c1d85334be633764057. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 14

Intelligence 14 IOCs YARA 4 File information Comments

SHA256 hash:	262e636e1017d908369407ee3bfa69bde9201e2c98c20c1d85334be633764057
SHA3-384 hash:	1d1286bf0d9a241fb3740604cd0a972dd3728b67e395d42756f89faa4ecdfade08eab8597f05b848356f8a797b415e20
SHA1 hash:	9000b86b601578e46b0ccb65e1f03ded17d39a57
MD5 hash:	52a59189299e6e28c7f3737a21875641
humanhash:	stairway-hot-pizza-floor
File name:	8le20h.bin
Download:	download sample
File size:	41'984 bytes
First seen:	2024-05-22 05:07:38 UTC
Last seen:	2024-05-22 05:27:52 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4f1463f8c0617e0ceb95bb4c6a849655
ssdeep	768:Ef7Shusc1TMbYI3aW31MjHCPip1MmMbC0g:gmhe12YI3H1MjHCPizDoC0g
TLSH	T1BE135B8363A019F6D69BC97189B78D2AD9B0F9504B2287CF9670C1614DA2FE43B3D34D
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	1ZRR4H
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

369

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

262e636e1017d908369407ee3bfa69bde9201e2c98c20c1d85334be633764057.exe

Verdict:

Malicious activity

Analysis date:

2024-05-22 05:09:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/d244829f-42ac-49eb-8e07-953313c25b8c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.PUA.Tool.VulnDriver.6.4368.25086.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=664d7da425570c503d850203win7simulatehigh_evasion

Tags:

Encryption Execution Network Static Variant

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the drivers directory

Running batch commands

Launching a process

Creating a file

DNS request

Connection attempt

Sending a custom TCP request

Creating a service

Loading a system driver

Creating a file in the Windows subdirectories

Searching for the window

Enabling autorun for a service

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm masquerade packed pup

Link:

https://www.filescan.io/uploads/664d7db6ad9cabd239933489/reports/aef6b856-f3ea-4120-9292-908cc04c7c87/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/262e636e1017d908369407ee3bfa69bde9201e2c98c20c1d85334be633764057

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/8a9ab26e-81b6-4d04-a11a-af63669a53ae

Result

Threat name:

n/a

Detection:

malicious

Classification:

rans

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1445531

Signature

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample is not signed and drops a device driver

Sigma detected: Curl Download And Execute Combination

Yara detected GDRV Vulnerable Kernel Driver

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/262e636e1017d908369407ee3bfa69bde9201e2c98c20c1d85334be633764057

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/262e636e1017d908369407ee3bfa69bde9201e2c98c20c1d85334be633764057/

Threat name:

Win64.Trojan.Casdet

Status:

Malicious

First seen:

2024-05-14 08:36:41 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eyxgg3qqc7mqqnuua7xdx6tjxxusahrmtdbayhmfgnf6mm3wiblq._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

persistence

Link:

https://tria.ge/reports/240522-fsj54ada5y/

Behaviour

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Downloads MZ/PE file

Drops file in Drivers directory

Sets service image path in registry

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/7cda9b4f-da17-41d9-83d6-2e9d4a0f9f8a

Unpacked files

SH256 hash:

31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427

MD5 hash:

9ab9f3b75a2eb87fafb1b7361be9dfb3

SHA1 hash:

fe10018af723986db50701c8532df5ed98b17c39

Detections:

PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_31F4

VULN_PUA_GIGABYTE_Driver_Jul22_1

Link:

https://www.unpac.me/results/bcb50393-0228-4934-9d2e-1f754487b81e/

Parent samples :

262e636e1017d908369407ee3bfa69bde9201e2c98c20c1d85334be633764057
185d1aa9bff1b8f51d371e8b471011a4816e727603edd36844da7efc6183304b
7a976388b064594086b73e3e08a3b95b97a9eea7610bf9c4ac53a2d10304e12b
7b4ca5b780438bef6eca1d5241c5a5f9afbed7e9eacc62300c5ac64fe9e1030a
cc921933142a27e5a98ed63bd2ca5323a53e083e8f9f7f5c15da1b85eac276f6
638bfb452ad5c2ce2bc9aab6a7dd65665b886d79abd1ce66e617d33781036764
7409f72c3bec45343af484f26fefee09ec591ddc2f87aaff261337209dcbedc4
884896168506a9a261be5a3fdd186f88a2f11816b99deb6636b13ccaaffbdcdf
4bf19e234784a69a8e42fa345a703af865dbf4b58342af810dc51d5d902211c8
2d3272c4e2daca9621f56b0724743c467a8a70cd30826b505bb7c3d3a1dfd482
cab05e6b1c523c1c04f1c8806bcb1f1a0e2418f8179f57db80aa1dc5cd939844
f2943a108d98faef6c3411f0ad1235f85f3196cff70cd7d48565c92d0a21d060
3a9fe422216a414d420cbd1e20186da127fb5be80d50f40ef7db6215b7feb2f1
ed980429e185979a8bf0e6f71c3d16b61e0845189dd18785dcd94163566e2f51
2bd7ca44d7dc856bc104eefb0a01f3779bd61224b16c03d56dee1bffc8c08581
cbb5470f103fe2ef9344dbd99f892fd31f687c62225abdfaa76d3eea8b36feb4

SH256 hash:

262e636e1017d908369407ee3bfa69bde9201e2c98c20c1d85334be633764057

MD5 hash:

52a59189299e6e28c7f3737a21875641

SHA1 hash:

9000b86b601578e46b0ccb65e1f03ded17d39a57

Detections:

PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_31F4

VULN_PUA_GIGABYTE_Driver_Jul22_1

Link:

https://www.unpac.me/results/bcb50393-0228-4934-9d2e-1f754487b81e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/262e636e1017d908369407ee3bfa69bde9201e2c98c20c1d85334be633764057

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_31F4 Create hunting rule
Author:	Florian Roth
Description:	Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys
Reference:	https://github.com/magicsword-io/LOLDrivers

Rule name:	VULN_PUA_GIGABYTE_Driver_Jul22_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a vulnerable GIGABYTE driver sometimes used by malicious actors to escalate privileges
Reference:	https://twitter.com/malmoeb/status/1551449425842786306

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high
CHECK_TRUST_INFO	Requires Elevated Execution (level:requireAdministrator)	high

Reviews

ID	Capabilities	Evidence
KERNEL_API	Manipulates Windows Kernel & Drivers	ntdll.dll::RtlCreateRegistryKey ntdll.dll::RtlWriteRegistryValue ntdll.dll::RtlInitUnicodeString
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess ntdll.dll::NtQuerySystemInformation KERNEL32.dll::LoadLibraryExW
WIN_BASE_IO_API	Can Create Files	ntdll.dll::NtCreateFile KERNEL32.dll::CreateFileW ntdll.dll::NtDeviceIoControlFile

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample