MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0739718c03bd39daad459142116b886d6138cfe887d30b02942e01b9d238dd13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0739718c03bd39daad459142116b886d6138cfe887d30b02942e01b9d238dd13
SHA3-384 hash:	1676761bce8095d2ab891fa3d2ba63b64f45bbab6d0ab669e74344fd08a1ec2075d64abe54d62220281e6670ab02a61f
SHA1 hash:	ef353297dc7d9282af245dd5777daf1c54d1e510
MD5 hash:	5a33db3fcde240d479c9e3ad02fa09f1
humanhash:	north-one-cat-chicken
File name:	file.exe
Download:	download sample
Signature	Lu0Bot Alert Create hunting rule
File size:	2'370'048 bytes
First seen:	2023-04-09 06:56:59 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep	49152:912q08HdEFVwcQYTTekQ3YbF4tPKI3L6Dhf7PL:WAlvCTWYbFF7
TLSH	T156B533939AED4734D6B267B018B785930E30BC4624A5826F71E39C9C68F29C179353BF
TrID	70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 3.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):
dhash icon	f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe Lu0Bot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

268

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

file.exe

Verdict:

Malicious activity

Analysis date:

2023-04-09 06:57:32 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/2ddf71c5-f62f-4080-b6ea-aaba6e748f26

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/381019/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.29170.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% subdirectories

Running batch commands

Creating a process with a hidden window

Creating a process from a recently created file

Сreating synchronization primitives

DNS request

Sending a UDP request

Sending a custom TCP request

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/77102/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

EvasionGetTickCount

EvasionQueryPerformanceCounter

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/0739718c03bd39daad459142116b886d6138cfe887d30b02942e01b9d238dd13

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/1feed0cd-f035-4628-a60e-a1b6ce83bfdc

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1210902

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0739718c03bd39daad459142116b886d6138cfe887d30b02942e01b9d238dd13/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a44xddadxu45vlkfsfbbc24invqtrt7iq7jqwauufya3tury3ujq._file

Threatray suspicious

Verdict:

suspicious

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

persistence

Link:

https://tria.ge/reports/230409-hqxphsbe4s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

Adds Run key to start application

Executes dropped EXE

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

7c7dc65aa22e2c8da4b28aa5a4153375191df4766a29e87bf12d7333df89b9a5

MD5 hash:

f2971e3eddfd52ca6a2c4cc206283bd6

SHA1 hash:

52cc13bacc3621bc59e432b87d0e0a53860cb2a5

Link:

https://www.unpac.me/results/e21f52b2-7d0e-4eb3-9d0e-c83b8a77bc8f/

SH256 hash:

0739718c03bd39daad459142116b886d6138cfe887d30b02942e01b9d238dd13

MD5 hash:

5a33db3fcde240d479c9e3ad02fa09f1

SHA1 hash:

ef353297dc7d9282af245dd5777daf1c54d1e510

Link:

https://www.unpac.me/results/e21f52b2-7d0e-4eb3-9d0e-c83b8a77bc8f/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0739718c03bd/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0739718c03bd39daad459142116b886d6138cfe887d30b02942e01b9d238dd13

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/381019/