MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03ef188886996b71ebe83d01ebce193443a003f61c85efe495eb3bbd58848a70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03ef188886996b71ebe83d01ebce193443a003f61c85efe495eb3bbd58848a70
SHA3-384 hash: 427b7d2897e219414253273e76b7bb7d2fb5a53cfd8a0f696671ea76d4cfa723fc0e1ea8a74a1161c1b3b9168c161e9a
SHA1 hash: 90a9ff305b523631813c3f8c802bc830d0b961e7
MD5 hash: e3323a9b37311e91eb8d67048e6fce57
humanhash: lima-earth-mars-thirteen
File name:SecuriteInfo.com.Win32.Malware-gen.8457.27733
Download: download sample
File size:22'855'449 bytes
First seen:2024-01-20 13:29:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 36aca8edddb161c588fcf5afdc1ad9fa (2 x ValleyRAT, 1 x PrivateLoader, 1 x RedLineStealer)
ssdeep 393216:azMgOJRWTBOoNRLtzS+IfVlhQ+glwY6AyBpfvWKEe6lH22CNReMo2R8Hsg5/Xa8F:0MgOJRWT5RLtYfVlhQ+gRTyz3WKeWzeD
Threatray 2 similar samples on MalwareBazaar
TLSH T16137CF20765AC12AD12E4DB0192C97FAD01CADAA3F6144DBB3DCB91A6B747C31332E57
TrID 58.2% (.OCX) Windows ActiveX control (116521/4/18)
28.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
5.2% (.EXE) Win64 Executable (generic) (10523/12/4)
2.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 901e869696961696
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
292
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.8457.27733.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Searching for the window
Creating a file in the %AppData% subdirectories
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Creating a file
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm evasive fingerprint installer lolbin msiexec overlay packed remote setupapi shell32
Link:
https://www.filescan.io/uploads/65abcae62593e1cd0baafa23/reports/4287b1c5-1217-404d-b76e-dc9c9862756c/overview
Verdict:
Suspicious
Labled as:
Adware.WebCompanion
Link:
https://www.hybrid-analysis.com/sample/03ef188886996b71ebe83d01ebce193443a003f61c85efe495eb3bbd58848a70
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
10 / 100
Link:
https://www.joesandbox.com/analysis/1377973
Behaviour
Behavior Graph:
n/a
Score:
84%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/03ef188886996b71ebe83d01ebce193443a003f61c85efe495eb3bbd58848a70
Gathering data
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2024-01-11 04:13:34 UTC
File Type:
PE (Exe)
Extracted files:
527
AV detection:
12 of 23 (52.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=apxrrcegtfvxd27ihua6xtqzgrb2aa7wdsc67zev5m532weerjya._file
Verdict:
malicious
Similar samples:
e7258b68c24a165c0c61f1fe16a15dd642cf118eae9a4405d3d3cee174d1c72e
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/240120-qrwgvabac6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Enumerates connected drives
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_Sandworm_ArguePatch_Apr_2022_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect ArguePatch loader used by Sandworm group for load CaddyWiper
Reference:https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments