MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01a0842398ccd02d4ad01329e5d96c209b067cc31f93aa38b17a25e7cde8f07c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	01a0842398ccd02d4ad01329e5d96c209b067cc31f93aa38b17a25e7cde8f07c
SHA3-384 hash:	a0a424a829a295c444d85ff146652800b49874d8b98b59db90ced594b221252aa7b8a317b92bb455be9b268fdf73260a
SHA1 hash:	8f22fbf26974a481579fb7169868e832e60d28b5
MD5 hash:	aea92f195e214e79c32a3d62fd79ca2e
humanhash:	pip-spaghetti-eighteen-nuts
File name:	aea92f195e214e79c32a3d62fd79ca2e.exe
Download:	download sample
File size:	2'671'901 bytes
First seen:	2023-11-12 13:15:51 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f4639a0b3116c2cfc71144b88a929cfd (96 x GuLoader, 53 x Formbook, 37 x VIPKeylogger)
ssdeep	49152:Cl2s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsS:CzzX71oDCRAZUviAHImDqia7hsS
Threatray	257 similar samples on MalwareBazaar
TLSH	T198C52300B241DC42DDB906F41C6AE2BA50743FBB641EB56337817AFE2AF2E31954F256
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	80a4a6a4a6a6a480 (1 x RustyStealer)
Reporter	abuse_ch
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

303

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Malware@#1o2coqjl0l2yj.2594.21486.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% directory

Creating a process from a recently created file

Сreating synchronization primitives

Creating a window

Searching for synchronization primitives

Dragonfly

Gathering data

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

control installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/6550d014641154c7e3f3ec73/reports/b64d2d35-b8db-414b-b64f-55f9a407cc1b/overview

Hybrid Analysis Doina.Generic

Verdict:

Malicious

Labled as:

Doina.Generic

Link:

https://www.hybrid-analysis.com/sample/01a0842398ccd02d4ad01329e5d96c209b067cc31f93aa38b17a25e7cde8f07c

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Melcoz

Malware family:

Melcoz

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/dc425165-1a5b-47e7-9021-eaf7c0528348

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1341310

Signature

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/01a0842398ccd02d4ad01329e5d96c209b067cc31f93aa38b17a25e7cde8f07c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/01a0842398ccd02d4ad01329e5d96c209b067cc31f93aa38b17a25e7cde8f07c/

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-11-11 22:59:00 UTC

File Type:

PE (Exe)

Extracted files:

113

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=agqiii4yztic2swqcmu6lwlmecnqm7gdd6j2uofrpis6ptpi6b6a._file

Threatray malicious

Verdict:

malicious

Similar samples:

0c67ccd6b722d25bbe932693afe8d0895555d12442699122c8810d2d6610e2a8

1bb732330744dda9232ab0e291c9b5d5f8e76e9c649ed9e1e9f4327a0c7387dc

39eda85740817da8e123ed2c96fbe131356b31a6a98231a522e271cd35748829

725600f8e47bd1294331aa19c3bef6d31f37204afa2a5ba45036bc8307132d5b

88481fc9b8b2beb564ae58c9ad551d3810a15fbb58a7dc98944167e2f8f2dfd2

925fa028b1511d9fb57e7f69efebff4c34228222af3adc11cfc45d930e9f6983

b47036189825426c6e368fd21594aaba8dbdcf573464d2939f99da44c9874b97

c1aa65f7c2cc6beb7052c8ada46a3139fc01da66890f4153a7c5761292b71d61

+ 247 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/231112-qhs1csgg64/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes dropped EXE

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

6ff7a3b8317c9ae20fb36fad28a5c7472886967929fc49a941caa43bf3b6d4e7

MD5 hash:

511c4b2f9172ac186263df7f5ec7944c

SHA1 hash:

ed7900525a9d8ed8895e802b1efd886a2f8e7cda

Link:

https://www.unpac.me/results/e3b9c707-eacf-47db-be4b-ec16e5596126/

SH256 hash:

01a0842398ccd02d4ad01329e5d96c209b067cc31f93aa38b17a25e7cde8f07c

MD5 hash:

aea92f195e214e79c32a3d62fd79ca2e

SHA1 hash:

8f22fbf26974a481579fb7169868e832e60d28b5

Link:

https://www.unpac.me/results/e3b9c707-eacf-47db-be4b-ec16e5596126/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/01a0842398ccd02d4ad01329e5d96c209b067cc31f93aa38b17a25e7cde8f07c