MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01ff97cd06d4112f2ce2f37307f0b7fb4f220561ca70f2a500fe6e08d7807a7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 01ff97cd06d4112f2ce2f37307f0b7fb4f220561ca70f2a500fe6e08d7807a7e
SHA3-384 hash: 1cebe995490aa688c4be4fa25620d59e5aa8b85bcd774e402899dd5deda5d68ac04e4e42bbfe692d1e1dfcf0b2c69779
SHA1 hash: 9c435786383355f277d97ce0b6fd9ebe8fdb5bc5
MD5 hash: 06e551fe26dadecce8c00801f42a9bd7
humanhash: fix-william-two-snake
File name:SecuriteInfo.com.Variant.Cerbu.185638.9066.12623
Download: download sample
File size:14'848 bytes
First seen:2023-07-27 03:28:16 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 3fb7ec92dc5428dc25b22a2c07c4e9d8
ssdeep 192:NRmMnNWUzopleop9FAl1kV2ixmlhHppMIP3Rmof4c9xjH01QH3zkLXHIws0:NRmbDtrFAsVzIhdP3Rmo1wq2
Threatray 2'326 similar samples on MalwareBazaar
TLSH T18A628E76CA938978CFDE1FB005EB1E2E4140FA09520915A09F164F9F9CA57A7FA520CA
TrID 30.2% (.EXE) Win64 Executable (generic) (10523/12/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4505/5/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
246
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/434619/
Detection(s):
SecuriteInfo.com.Variant.Cerbu.185638.9066.12623.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64c1e47e4e8e3d7634758df6/reports/2d5a4b72-417f-40bd-8844-b6cbc813cc92/overview
Verdict:
Malicious
Labled as:
Cerbu.Generic
Link:
https://www.hybrid-analysis.com/sample/01ff97cd06d4112f2ce2f37307f0b7fb4f220561ca70f2a500fe6e08d7807a7e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bb2a35b4-be62-456c-92eb-202b987e5766
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1280808
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1280808 Sample: SecuriteInfo.com.Variant.Ce... Startdate: 27/07/2023 Architecture: WINDOWS Score: 60 33 Antivirus / Scanner detection for submitted sample 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 Machine Learning detection for sample 2->37 8 loaddll32.exe 1 2->8         started        10 kfoktdyi.exe 2->10         started        12 kfoktdyi.exe 2->12         started        process3 process4 14 rundll32.exe 1 2 8->14         started        17 cmd.exe 1 8->17         started        19 rundll32.exe 8->19         started        21 5 other processes 8->21 file5 31 C:\Users\user\AppData\...\kfoktdyi.exe, PE32 14->31 dropped 23 WerFault.exe 23 9 14->23         started        25 rundll32.exe 17->25         started        27 WerFault.exe 9 19->27         started        process6 process7 29 WerFault.exe 2 9 25->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/01ff97cd06d4112f2ce2f37307f0b7fb4f220561ca70f2a500fe6e08d7807a7e/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2023-07-26 15:58:05 UTC
File Type:
PE (Dll)
AV detection:
24 of 37 (64.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ah7zptig2qis6lhc6nzqp4fx7nhseblbzjypfjia7zxarv4apj7a._file
Verdict:
malicious
Similar samples:
30b3a610d92484107f21e5bc28f32d008decb661e8044bb782737ace569ac70b
37f3dc0db96f235594f3e2153e851add6103e86a79b81722a130c592d1981f0a
38dc7554359b82417ee81851f0bd42f9661cd4d4b70a648ae8a8cdf1e0b50b37
39ae0f728fa70f88393c1ff6e71502e300ef4197a5214b2cc99d42bb2683ba90
41a6b66b34474558a055b445266241047c38240b85fbf399be40e8841f742d83
a99019e3753a7babc2108dc67c77be0d5914b23051b1fd7a07f2b3a3ba840559
ba52afc3af14ee1c1310b78749df19e172aa004d356a8d974a6a00e7c9edf367
ce1ed6c75e5261ea509a09cf2cbb4eca2a28f9ac4bd40d0ede711608233546da
de57a6cd3f2dfb6b6de94dc37869f25974279719c50998ae11cb067606e1e04a
f7537939cb6791cf3b5919514a93bab3a03c8b1d4291817206543902ee63f81a
+ 2'316 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/230727-d1w4hsab5y/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Unpacked files
SH256 hash:
01ff97cd06d4112f2ce2f37307f0b7fb4f220561ca70f2a500fe6e08d7807a7e
MD5 hash:
06e551fe26dadecce8c00801f42a9bd7
SHA1 hash:
9c435786383355f277d97ce0b6fd9ebe8fdb5bc5
Link:
https://www.unpac.me/results/aa6aa414-f730-4aaf-a6d8-4f10a8e84603/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/01ff97cd06d4112f2ce2f37307f0b7fb4f220561ca70f2a500fe6e08d7807a7e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/434619/

Comments