MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0077e7d6e90ad972b64e90c343c617482f39505deff44ebff99ff49041252dcb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Hive


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0077e7d6e90ad972b64e90c343c617482f39505deff44ebff99ff49041252dcb
SHA3-384 hash: 336063a42f38234d9b2b6d75d9756971e26add847adbbbfa809ae7cbd9d5ac6483625d63cf6b874ac7a2986d2ed370e9
SHA1 hash: fa7742809154d42363fd65cabd613cff617d5973
MD5 hash: 3ddfc2152f8db17f2502ffeed26a7553
humanhash: autumn-kilo-washington-magnesium
File name:3ddfc2152f8db17f2502ffeed26a7553
Download: download sample
Signature Hive
Create hunting rule
File size:5'681'152 bytes
First seen:2022-07-04 10:19:06 UTC
Last seen:2022-07-04 11:16:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ef5ee1a30d4a83fd2256bd92297da50a (7 x Hive, 1 x RedLineStealer, 1 x 000Stealer)
ssdeep 49152:6tSHkCyvh0uhRLTxd+K7EIrbgGCpLXadU/8IrOZHZVRcfM62d7Ep2W/61jn+E0tE:65veub/x6ebgGCpLXSRZ0Hsx97Du
Threatray 1'662 similar samples on MalwareBazaar
TLSH T1F4464B90F9DB84F2EA03557004A762AF23306E0A4B39DEC7D6407F6AFCB66E10977525
gimphash b85fba3ca3375a0eca27df48a172127e99cd708fac23df86d74c29fb5cb344ca
TrID 37.2% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
27.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
14.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
5.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter zbetcheckin
Tags:32 exe Hive

Intelligence

File Origin
# of uploads :
2
# of downloads :
337
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.17736.5580.5333.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Reading critical registry keys
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Stealing user critical data
Sending a TCP request to an infection source
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug barys trickbot wacatac
Link:
https://www.filescan.io/uploads/62c2bf1111764e36f8129540/reports/4f315128-5d0b-4a2a-b60f-8ebe4a6fecec/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CoinMiner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1e077133-44dc-4c8d-b70a-52f399f48c79
Result
Threat name:
000Stealer, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1024104
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Machine Learning detection for dropped file
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Xmrig
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected 000Stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 656596 Sample: vthFJBIgKX Startdate: 04/07/2022 Architecture: WINDOWS Score: 100 68 Sigma detected: Xmrig 2->68 70 Multi AV Scanner detection for domain / URL 2->70 72 Antivirus detection for URL or domain 2->72 74 6 other signatures 2->74 12 vthFJBIgKX.exe 2 2->12         started        17 UGBOMITO.exe 2->17         started        19 UGBOMITO.exe 1 2->19         started        21 UGBOMITO.exe 2->21         started        process3 dnsIp4 64 185.112.83.111, 49763, 49769, 49770 SUPERSERVERSDATACENTERRU Russian Federation 12->64 58 C:\Users\user\AppData\Local\Temp\rat.exe, PE32 12->58 dropped 96 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 12->96 98 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 12->98 100 Tries to harvest and steal ftp login credentials 12->100 102 3 other signatures 12->102 23 rundll32.exe 1 12->23         started        file5 signatures6 process7 process8 25 rat.exe 3 23->25         started        file9 56 C:\Users\user\...\DNMMQNNNPxACWOZPXDdd.exe, PE32 25->56 dropped 84 Antivirus detection for dropped file 25->84 86 Multi AV Scanner detection for dropped file 25->86 88 Detected unpacking (changes PE section rights) 25->88 90 2 other signatures 25->90 29 DNMMQNNNPxACWOZPXDdd.exe 5 25->29         started        signatures10 process11 file12 60 C:\ProgramData\vhjvjhjbgjg\UGBOMITO.exe, PE32 29->60 dropped 104 Antivirus detection for dropped file 29->104 106 Multi AV Scanner detection for dropped file 29->106 108 Detected unpacking (changes PE section rights) 29->108 110 2 other signatures 29->110 33 cmd.exe 1 29->33         started        signatures13 process14 signatures15 66 Uses schtasks.exe or at.exe to add and modify task schedules 33->66 36 UGBOMITO.exe 15 5 33->36         started        41 conhost.exe 33->41         started        43 timeout.exe 1 33->43         started        process16 dnsIp17 62 microsoftvisualstudio.wtf 185.105.110.4, 49873, 49879, 80 VDSINA-ASRU Russian Federation 36->62 54 C:\ProgramData\vhjvjhjbgjg\ton.exe, PE32+ 36->54 dropped 76 Antivirus detection for dropped file 36->76 78 Multi AV Scanner detection for dropped file 36->78 80 Detected unpacking (changes PE section rights) 36->80 82 3 other signatures 36->82 45 ton.exe 36->45         started        48 cmd.exe 1 36->48         started        file18 signatures19 process20 signatures21 92 Multi AV Scanner detection for dropped file 45->92 94 Machine Learning detection for dropped file 45->94 50 conhost.exe 48->50         started        52 schtasks.exe 1 48->52         started        process22
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0077e7d6e90ad972b64e90c343c617482f39505deff44ebff99ff49041252dcb/
Threat name:
Win32.Trojan.Phonzy
Create hunting rule
Status:
Malicious
First seen:
2022-07-01 18:37:47 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ab36pvxjblmxfnsosdbuhrqxjaxtsuc5572e5p7zt72jaqjffxfq._file
Verdict:
malicious
Similar samples:
1a16288bf4484b2a6692dcb7244942d7bea94ce3597c175910f91cc2b2613365
Hive
52d14c9cd56aa41ba98a24a4a3dc3674f7e281c3d79f6aca141382fb56585bcd
Hive
5460cbecf56cf0527a162da6e9232c055912ae695990c1894a32b08055f45d37
Hive
86ef41e44779b109e70b7d34c011b341c2d90654b149a718a380205287256bef
Hive
bc06c918fab5afbb61d15611dedadbc9012cf9e4979e9d3f261a9046c306bb87
Hive
c3a2aedb10f9b59ecfc94aafcc041c885727f5f34d1db8bb9ff41cd910ef4eab
Hive
da266d429a932be228984ed5b0a0b030e5c33493bd6ef6a90bce9502eec38473
Hive
e100b492468b71cd42e556b9c5c59e3cf5d7b2f1426e2388102c71f8ba997012
Hive
f32f9fed2539cf3a6f585bc961035ccf3a03095c1f27e688f2da2811eca045f1
Hive
+ 1'652 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/220704-mck6sagdfp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
0077e7d6e90ad972b64e90c343c617482f39505deff44ebff99ff49041252dcb
MD5 hash:
3ddfc2152f8db17f2502ffeed26a7553
SHA1 hash:
fa7742809154d42363fd65cabd613cff617d5973
Link:
https://www.unpac.me/results/bdbd9177-060a-4271-ad71-4059044da4bc/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0077e7d6e90a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Hive

Executable exe 0077e7d6e90ad972b64e90c343c617482f39505deff44ebff99ff49041252dcb

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2253752/

Comments


Avatar
zbet commented on 2022-07-04 10:19:10 UTC

url : hxxp://185.112.83.111/pon.exe