MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04815de6b97b42726be71061fb5dd0ed9f8e5dbd750358f3a01a39e72187933e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Ousaban

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	04815de6b97b42726be71061fb5dd0ed9f8e5dbd750358f3a01a39e72187933e
SHA3-384 hash:	3ead3086ca8d7d7f6b9623783b480ebfd1b3f290793f2bb3119237341982be331aac1d134cb3ecf2432bf772e65841ca
SHA1 hash:	fced3d2c58b0eb7c80a3f63802f02015617afa85
MD5 hash:	932c72522c6ec3d2a1d8780d98a934df
humanhash:	social-iowa-connecticut-kansas
File name:	Informe-NF.e.VLRZXSVZVYDQNIJMNKOPHDIHPNYWTY_.msi
Download:	download sample
Signature	Ousaban Create hunting rule
File size:	288'768 bytes
First seen:	2021-08-16 19:13:12 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	3072:Z3ygYXkj7q0vTYDryO1nT2U6ij4qpXqnnDibAJBVkF9nY5At+3DJLCA4h:Z5i32Tqp4nwEOY5At+3DJLCA
Threatray	4'027 similar samples on MalwareBazaar
TLSH	T13D548C0573CB867BD9DE07336F4BC7A29A72FC748066C11B4299760E2CF5189E2636E1
Reporter	warz_s
Tags:	Banload brazil msi ousaban

Intelligence

File Origin

# of uploads :

# of downloads :

984

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/179697/

Detection(s):

SecuriteInfo.com.Trojan-Spy.Agent.22897.UNOFFICIAL

SecuriteInfo.com.JS.Obfus-1914.UNOFFICIAL

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/04815de6b97b42726be71061fb5dd0ed9f8e5dbd750358f3a01a39e72187933e

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/833826

Signature

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Powershell creates an autostart link

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/04815de6b97b42726be71061fb5dd0ed9f8e5dbd750358f3a01a39e72187933e/

Threat name:

Script-JS.Backdoor.Heuristic

Status:

Malicious

First seen:

2021-08-16 19:14:15 UTC

AV detection:

5 of 28 (17.86%)

Threat level:

2/5

Verdict:

malicious

Result

Malware family:

n/a

Score:

9/10

Tags:

bootkit evasion macro persistence themida trojan xlm

Link:

https://tria.ge/reports/210816-jp43f3cx9x/

Behaviour

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Windows directory

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Adds Run key to start application

Checks whether UAC is enabled

Enumerates connected drives

Looks up external IP address via web service

Writes to the Master Boot Record (MBR)

Checks BIOS information in registry

Drops startup file

Loads dropped DLL

Themida packer

Blocklisted process makes network request

Executes dropped EXE

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/04815de6b97b42726be71061fb5dd0ed9f8e5dbd750358f3a01a39e72187933e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.