MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05b7636daa1fcd8855554e04c865b868c5c658fca6adeaf2f28a6ea3a7b3bca6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05b7636daa1fcd8855554e04c865b868c5c658fca6adeaf2f28a6ea3a7b3bca6
SHA3-384 hash: 6356c92c1c8ebe5e2471e81c14341626b8f370e94fa4df9b6016fc7c08c0cd9f2a09ce516ce0f10c0983bf93327d03c3
SHA1 hash: 941f8a7476f01d9d06440b3d0736a4b70c108359
MD5 hash: 81ad4b6ee847b58a6de4fadc8e5ac0ae
humanhash: four-earth-purple-robin
File name:81ad4b6ee847b58a6de4fadc8e5ac0ae.dll
Download: download sample
File size:1'672'832 bytes
First seen:2023-12-04 09:49:36 UTC
Last seen:2023-12-04 11:22:09 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash ffce77b060e7b2ed38dea14b0235dc8e
ssdeep 24576:xOeh7E7IJbtEJEHng8wGrQTLq73xaH7pbHTJZo4HwJ+qx3:xOWFJbtSMXoTLq73xKfJZ7w+qN
TLSH T1B8755B12F4FFE80FCA762435866D789AB79B556651B73DC0297C2C2886B72B13990C0F
TrID 38.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
24.6% (.EXE) Win64 Executable (generic) (10523/12/4)
11.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.5% (.EXE) Win32 Executable (generic) (4505/5/1)
4.7% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon dc9c0acc9696b2b4
Reporter abuse_ch
Tags:dll

Intelligence

File Origin
# of uploads :
2
# of downloads :
323
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/462348/
Detection(s):
SecuriteInfo.com.Trojan.Siggen21.43602.14380.12480.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug overlay packed
Link:
https://www.filescan.io/uploads/656da0cffb43e835e6bd8673/reports/2e1ac299-0683-4ec3-8f5a-c16cb33a3e98/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/05b7636daa1fcd8855554e04c865b868c5c658fca6adeaf2f28a6ea3a7b3bca6
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Gh0st RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3a971608-ac1d-4a2f-85df-6c2a61344ca8
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1353069
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1353069 Sample: gUu54RBkvQ.dll Startdate: 04/12/2023 Architecture: WINDOWS Score: 56 19 Antivirus / Scanner detection for submitted sample 2->19 21 Multi AV Scanner detection for submitted file 2->21 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        13 rundll32.exe 7->13         started        15 36 other processes 7->15 process5 17 rundll32.exe 9->17         started       
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/05b7636daa1fcd8855554e04c865b868c5c658fca6adeaf2f28a6ea3a7b3bca6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05b7636daa1fcd8855554e04c865b868c5c658fca6adeaf2f28a6ea3a7b3bca6/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-10-27 13:29:00 UTC
File Type:
PE (Dll)
Extracted files:
12
AV detection:
21 of 37 (56.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aw3wg3nkd7gyqvkvjycmqznyndc4mwh4u2w6v4xsrjxkhj5txsta._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/231204-ltxepsad63/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
05b7636daa1fcd8855554e04c865b868c5c658fca6adeaf2f28a6ea3a7b3bca6
MD5 hash:
81ad4b6ee847b58a6de4fadc8e5ac0ae
SHA1 hash:
941f8a7476f01d9d06440b3d0736a4b70c108359
Link:
https://www.unpac.me/results/52ede004-855b-4b52-8dd7-6d7f0cceb83f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/05b7636daa1fcd8855554e04c865b868c5c658fca6adeaf2f28a6ea3a7b3bca6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Armadillov1xxv2xx
Create hunting rule
Author:malware-lu
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/462348/

Comments