MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d18bad61d44b6c780686eb1592d212226f69a0a0b39dc9d67d00de32efc52115. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d18bad61d44b6c780686eb1592d212226f69a0a0b39dc9d67d00de32efc52115
SHA3-384 hash: 139df356cd57cec33aa44888c9b683724c23126b1fd7b499d1edfeb6552b380bb4f56e2915a9fd81f08256732f69da48
SHA1 hash: 561d6ddd4524e745bfb750f779360977fed2eba3
MD5 hash: 24bfc71a004b1a200e7dba1975f1c103
humanhash: butter-autumn-earth-mobile
File name:MV ALPHA CONFIDENCE.exe
Download: download sample
File size:1'121'791 bytes
First seen:2022-10-24 17:58:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:EAOcZjxMX5xfS/mZfx/sSQtNIkK8xfg9vf:Sf5xfZfl1qNs8O9X
Threatray 2'386 similar samples on MalwareBazaar
TLSH T1D135AC43F19D852DE8720DB119B89717ECE87CD3281586EBF3987AE9C633942213C65E
TrID 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10523/12/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 00e0f0f0e0e0c000 (4 x SnakeKeylogger, 2 x AgentTesla)
Reporter Anonymous
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MV ALPHA CONFIDENCE.exe
Verdict:
Suspicious activity
Analysis date:
2022-10-24 18:01:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7ee16cbf-92dc-45e6-9d54-5efc4c95690c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/323569/
Detection(s):
SecuriteInfo.com.Gen.Variant.Johnnie.221809.751.14920.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/45094/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/81566ece-519e-42b2-9ffd-efac64338967
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
36 / 100
Link:
https://www.joesandbox.com/analysis/1096949
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 729591 Sample: MV ALPHA CONFIDENCE.exe Startdate: 24/10/2022 Architecture: WINDOWS Score: 36 10 Multi AV Scanner detection for submitted file 2->10 6 MV ALPHA CONFIDENCE.exe 3 31 2->6         started        process3 process4 8 wscript.exe 1 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d18bad61d44b6c780686eb1592d212226f69a0a0b39dc9d67d00de32efc52115/
Threat name:
Win32.Trojan.Bingoml
Create hunting rule
Status:
Malicious
First seen:
2022-10-24 08:18:07 UTC
File Type:
PE (Exe)
Extracted files:
44
AV detection:
17 of 40 (42.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2gf22youjnwhqbug5mkzfuqsejxwtifawoo4tvt5adpdf36feekq._file
Verdict:
unknown
Similar samples:
06b02574925948a3f418ba2851f10585086a5f9b25d8f4e7de62dd52c6a56153
2e37d7372a97df9e3955837eeae856489541aab815dffabc00bbc72af6483e9b
4ba76cd175c0794a97f8782befedd78e3f673b59e3453f20a61a39e4be859726
b0c5a3e2456d9df495e299db88e2431ab0133ea2327d885f6234ecf8ba5805e9
b1f692dd52aae8317db7cfd262a4bcc053cf721fc7a00bf66f4acc7cb5cc6cbc
b3a3645cf2d804bebd0d8049b70c95ae545ff06ca2acc9f85721a1d1f3c9b5b8
ba921e5bd4687eec051d4e646756bb2930ec900abf061b94761d6944f906afba
+ 2'376 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221024-wlwtbahhg2/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Unpacked files
SH256 hash:
d18bad61d44b6c780686eb1592d212226f69a0a0b39dc9d67d00de32efc52115
MD5 hash:
24bfc71a004b1a200e7dba1975f1c103
SHA1 hash:
561d6ddd4524e745bfb750f779360977fed2eba3
Link:
https://www.unpac.me/results/70d51cf4-1ef1-4344-809f-32c780a6b411/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d18bad61d44b6c780686eb1592d212226f69a0a0b39dc9d67d00de32efc52115

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:sfx_pdb
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.
Rule name:sfx_pdb_winrar_restrict
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/323569/

Comments