🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 11


Intelligence 11 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3
SHA3-384 hash: 2e135328424eca42e18c0627dddfc0e5d6b6b2b8822f702841167a92094c998c016d4a267f569eabf31a091ee715c674
SHA1 hash: 770afbd27b0062f0587f70a4c5363a28e6a54063
MD5 hash: 5096bea0badb422849e9306cf9a8da9c
humanhash: texas-zebra-beer-romeo
File name:SecuriteInfo.com.Trojan.Siggen10.59370.11705.17039
Download: download sample
Signature Mirai
Create hunting rule
File size:1'212'560 bytes
First seen:2024-03-31 02:21:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a2811931084b6dcda3f7edcb0d2009ac (1 x CobaltStrike, 1 x Mirai, 1 x SimpleHelp)
ssdeep 24576:chEbagUZYxiornbB2RXoBn7DNXSBDCCdMUQMMn5STkhC+:KEbnxiornbsRXoZNSBDAUQZ5TR
Threatray 7 similar samples on MalwareBazaar
TLSH T18A45125275C2DDB1DA92547066098BB2CB73F332035684D3A7B01E9EDE352E29B37389
TrID 32.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.7% (.SCR) Windows screen saver (13097/50/3)
11.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon 72fcb0a2a0b0f07c (9 x SimpleHelp, 4 x Mirai, 1 x CobaltStrike)
Reporter SecuriteInfoCom
Tags:exe mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
316
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3.exe
Verdict:
Malicious activity
Analysis date:
2024-03-31 02:23:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d84c934e-1111-41ba-83c6-257bb6725336

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %temp% subdirectories
Moving a file to the %AppData% subdirectory
Launching a process
Creating a file
Сreating synchronization primitives
Searching for synchronization primitives
Replacing files
Delayed reading of the file
Searching for the window
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint lolbin overlay packed remote shell32
Link:
https://www.filescan.io/uploads/6608c8cc6a2a018f46d3f680/reports/ffa595cc-f487-4822-89c3-2753f312e3f4/overview
Verdict:
Malicious
Labled as:
TrojanSpy.Xegumumune
Link:
https://www.hybrid-analysis.com/sample/03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e753b776-edd8-4f6d-975b-da0948e6d730
Result
Threat name:
n/a
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
66 / 100
Link:
https://www.joesandbox.com/analysis/1417869
Signature
Contains functionality to change the desktop window for a process (likely to hide graphical interactions)
Contains functionality to register a low level keyboard hook
Contains functionalty to change the wallpaper
Contains VNC / remote desktop functionality (version string found)
Creates autostart registry keys to launch java
Deletes keys which are related to windows safe boot (disables safe mode boot)
Enables network access during safeboot for specific services
Found API chain indicative of debugger detection
Installs a global keyboard hook
Java source code contains very large array initializations
Multi AV Scanner detection for submitted file
Submitted sample is a known malware sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1417869 Sample: SecuriteInfo.com.Trojan.Sig... Startdate: 31/03/2024 Architecture: WINDOWS Score: 66 82 help.supportinthecloud.com 2->82 94 Multi AV Scanner detection for submitted file 2->94 96 Found API chain indicative of debugger detection 2->96 98 Contains functionality to register a low level keyboard hook 2->98 100 Java source code contains very large array initializations 2->100 10 SecuriteInfo.com.Trojan.Siggen10.59370.11705.17039.exe 750 2->10         started        15 SimpleService.exe 2->15         started        signatures3 process4 dnsIp5 84 help.supportinthecloud.com 54.243.180.93, 49734, 49735, 49736 AMAZON-AESUS United States 10->84 72 C:\Users\user\AppData\...\utils_wnative64.dll, PE32+ 10->72 dropped 74 C:\Users\user\AppData\...\utils_wnative.dll, PE32 10->74 dropped 76 C:\Users\user\AppData\Roaming\...\shcad.exe, PE32 10->76 dropped 78 60 other files (none is malicious) 10->78 dropped 106 Submitted sample is a known malware sample 10->106 108 Contains VNC / remote desktop functionality (version string found) 10->108 17 Remote Support.exe 10->17         started        22 Remote SupportECompatibility.exe 4 10->22         started        24 cacls.exe 1 10->24         started        30 12 other processes 10->30 26 SimpleService.exe 15->26         started        28 session_win.exe 15->28         started        file6 signatures7 process8 dnsIp9 80 127.0.0.1 unknown unknown 17->80 68 C:\ProgramData\SimpleHelp\...\elev_win.exe, PE32 17->68 dropped 70 C:\ProgramData\...\SimpleService.exe, PE32 17->70 dropped 102 Installs a global keyboard hook 17->102 32 elev_win.exe 17->32         started        35 cacls.exe 17->35         started        37 cacls.exe 17->37         started        47 2 other processes 17->47 39 cacls.exe 1 22->39         started        41 conhost.exe 24->41         started        104 Deletes keys which are related to windows safe boot (disables safe mode boot) 26->104 43 javaw.exe 28->43         started        45 conhost.exe 30->45         started        49 5 other processes 30->49 file10 signatures11 process12 signatures13 86 Contains functionalty to change the wallpaper 32->86 51 elev_win.exe 32->51         started        53 conhost.exe 35->53         started        55 conhost.exe 37->55         started        57 conhost.exe 39->57         started        59 javaw.exe 43->59         started        61 conhost.exe 47->61         started        63 conhost.exe 47->63         started        process14 process15 65 SimpleService.exe 51->65         started        signatures16 88 Creates autostart registry keys to launch java 65->88 90 Contains functionality to change the desktop window for a process (likely to hide graphical interactions) 65->90 92 Enables network access during safeboot for specific services 65->92
Score:
88%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3
Detection:
mirai
Create hunting rule
Link:
https://mwdb.cert.pl/sample/03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aordnuxn6vgmyeoxvxwglxicypxe27p7mitm5ob4lon6irzjhhzq._file
Verdict:
malicious
Similar samples:
2b0d96e0813d17062eacd208c02246fbd3169153e5e8d9e56339921aef78c664
Mirai
60ba0c33a034e1f96fc43d5e51703e0d8fcc0a78ad429f1ba8a91868992136eb
Mirai
7fd8743d7db3b41fd686d8225cee3937cee621ee1fee933cd5734be2ddd9eb7f
Mirai
95214d9b5c1664031bfd15faea7dff8d9eddbb4907d1b3bcfbcfd79c920e9e56
Mirai
ad3ed86e2f6af81178bc581cc7013e958f71cbca0a3e5bd76979cd72138deda1
Mirai
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/240331-ctkapsca6z/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
f16b39ef342323d997b2cc9b649a94b6ebd12954671f357d1ed690bd7eb5ba7f
MD5 hash:
71dc11c495355f883498ff5e8702bb3d
SHA1 hash:
9685190619088991a89ab6b96f8595453bb7f795
Link:
https://www.unpac.me/results/72bcdf52-941a-4454-b3d7-f8b3fe955ec9/
SH256 hash:
03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3
MD5 hash:
5096bea0badb422849e9306cf9a8da9c
SHA1 hash:
770afbd27b0062f0587f70a4c5363a28e6a54063
Link:
https://www.unpac.me/results/72bcdf52-941a-4454-b3d7-f8b3fe955ec9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/03a236d2edf54ccc11d7adec65dd02c3ee4d7dff6226ceb83c5b9be4472939f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:Armadillov1xxv2xx
Create hunting rule
Author:malware-lu
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
WININET.dll::InternetCloseHandle
WINHTTP.dll::WinHttpCloseHandle
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetDriveTypeA
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::WriteConsoleA
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::MoveFileExA
KERNEL32.dll::MoveFileA
KERNEL32.dll::GetFileAttributesA
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::GetUserNameA
WIN_HTTP_APIUses HTTP servicesWINHTTP.dll::WinHttpGetIEProxyConfigForCurrentUser
WINHTTP.dll::WinHttpGetProxyForUrl
WINHTTP.dll::WinHttpOpen
WIN_USER_APIPerforms GUI ActionsUSER32.dll::PeekMessageA
USER32.dll::CreateWindowExA

Comments