MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04bd0fba55c5d6c085f0ec24632020b392c1fe80b66fa725c0922a41fb4d8723. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04bd0fba55c5d6c085f0ec24632020b392c1fe80b66fa725c0922a41fb4d8723
SHA3-384 hash: d79abcf43d998ed86942d916b8057958f3fcef2f57d3429cb7aecf83d61a4a910eb3cd4c0952f70d68ca9c92f7197e48
SHA1 hash: 076653534f4278a577e9bf26db4f719a3c19d7b4
MD5 hash: 9ac6c1ddef063c772c569e1992129d2b
humanhash: mike-july-lamp-comet
File name:foFAKjZ2KD4TpfI.exe
Download: download sample
File size:778'752 bytes
First seen:2021-10-12 07:44:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:g5sJcwSEhiIkq3wxdTCsvnrRCmx2wbM00eXzfg7nUviKnXm5p:g5sFSEh3kQCd3QE230Lj0AVk
Threatray 113 similar samples on MalwareBazaar
TLSH T1BEF4C655F3439C12E557567354E461E3A10829C7E8888338EBB7BAA358CE3845F8CBDE
Reporter GovCERT_CH
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
foFAKjZ2KD4TpfI.exe
Verdict:
Malicious activity
Analysis date:
2021-10-12 07:51:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2f8a7a97-d988-4b7e-acae-4a396491d780

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/196792/
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.22128.3815.27296.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61653ccd1c2d58ba7402d99c/reports/299c5c3f-21f6-4ab0-a08c-ae44fc98aa01/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9b465bb0-c5ac-47a4-aa69-de99eb7d719e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/868377
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 500801 Sample: foFAKjZ2KD4TpfI.exe Startdate: 12/10/2021 Architecture: WINDOWS Score: 48 13 Multi AV Scanner detection for submitted file 2->13 6 foFAKjZ2KD4TpfI.exe 2 2->6         started        process3 process4 8 WerFault.exe 23 9 6->8         started        dnsIp5 11 192.168.2.1 unknown unknown 8->11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04bd0fba55c5d6c085f0ec24632020b392c1fe80b66fa725c0922a41fb4d8723/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2021-10-12 04:39:43 UTC
AV detection:
10 of 45 (22.22%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=as6q7osvyxlmbbpq5qsggibawojmd7uawzx2ojoasived62nq4rq._file
Verdict:
unknown
Similar samples:
0768e83e8d36f21ea90867dcf3935ee48795daf2e4a0017979e752b865c95d9e
2ee7df5c51dfb513822dcac9c5cdc1bac93aab89c632ad7defef8dea9f93fb4f
4964c618368217328e5fb70c84e047f18e5027ae0e6ea984b1b96c38ffad77c7
65914c4a71b3670aacb5f165076d8f7f6542be80661727fb6d5d8038c9f13e4d
76ee7eacfb1b508c6e8e3174aaa29cf4fdc946fe76114fd6047cb695eecc764f
9628b9421c345de90e366733c4713bd3e6f1b7c64465bb36cd284d9d55be08f7
9fa2ffcaaf492a5d9e68b376580871cce9d495d32934d90fe7e431b09de2c6d9
ac84f24af4ee7638d9ee6c5d4b080130a7e1055e5f9bfbc1991dc889a03f664c
f7936247eafae0bac645ae23aca25aa4c64d5ba7434d7f57daedccd0d8f8324c
fd1b80b0afe3eb7f567268b2ddb4f022a9ac086d78e836605f378ac63630bc22
+ 103 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/211012-jld72sbge7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
709ea7bcb054b705088235b842f7240aae5651851ace7b0f8930d506dd0137eb
MD5 hash:
0fe68620bcfb8a1f691ad339d1e4a3f5
SHA1 hash:
e35d8694287d6d2f84eeb6a481420151c277cc3f
Link:
https://www.unpac.me/results/711298bf-a27b-41ce-a694-afa7f13de7db/
SH256 hash:
43e38f251dbca9aa20f3470167e5427a7e7a7cdcd25f0b6b045ae8577cd3e345
MD5 hash:
f62ab5d3528d5a3b9e270ea1f9347868
SHA1 hash:
6a74e87711c615adbd9145f829a33f55b7e42dd6
Link:
https://www.unpac.me/results/711298bf-a27b-41ce-a694-afa7f13de7db/
SH256 hash:
04bd0fba55c5d6c085f0ec24632020b392c1fe80b66fa725c0922a41fb4d8723
MD5 hash:
9ac6c1ddef063c772c569e1992129d2b
SHA1 hash:
076653534f4278a577e9bf26db4f719a3c19d7b4
Link:
https://www.unpac.me/results/711298bf-a27b-41ce-a694-afa7f13de7db/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/04bd0fba55c5d6c085f0ec24632020b392c1fe80b66fa725c0922a41fb4d8723

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Executable exe 04bd0fba55c5d6c085f0ec24632020b392c1fe80b66fa725c0922a41fb4d8723

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/196792/

Comments