MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07451b0c3aaa3d6dcb79a4ece6b59a5176226f234527ca810c8c50469a54d070. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Kovter


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07451b0c3aaa3d6dcb79a4ece6b59a5176226f234527ca810c8c50469a54d070
SHA3-384 hash: 80aea363dba4bce898613c7369ffb80ba567f5f959eb46fda7772ab2ec93becae42d80968afff3756dc632b799688e75
SHA1 hash: 902d28437c0e5322d79237f451cbd8dffe66bfc6
MD5 hash: 46355d768d1028f7b95386d3ea309590
humanhash: muppet-illinois-delaware-wisconsin
File name:46355d768d1028f7b95386d3ea309590
Download: download sample
Signature Kovter
Create hunting rule
File size:238'080 bytes
First seen:2021-08-30 12:54:18 UTC
Last seen:2021-08-30 15:37:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 3072:e/uPeFvwhVyaNcWcBCOSrTorfyuq5mUF5eWEFb3AgM34udq9Y9fNgbec+1+F3t26:eU3hXfet3Agp0q9ygbX+1RzDU8
Threatray 559 similar samples on MalwareBazaar
TLSH T17234E099FBE7CFFCD19E0BF66465C7C479F0E028994BE74A204D64284B46BA583E02D1
Reporter zbetcheckin
Tags:32 exe Kovter

Intelligence

File Origin
# of uploads :
2
# of downloads :
955
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
46355d768d1028f7b95386d3ea309590
Verdict:
Malicious activity
Analysis date:
2021-08-30 13:00:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/70f27032-bfeb-46d8-82fb-b563ca19eea9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/183753/
Detection(s):
SecuriteInfo.com.Variant.Bulz.649365.81.27637.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
DNS request
Connection attempt
Sending a custom TCP request
Creating a file
Creating a process from a recently created file
Sending a UDP request
Creating a file in the %AppData% directory
Deleting a recently created file
Enabling the 'hidden' option for recently created files
Sending an HTTP POST request
Launching a process
Searching for the window
Sending an HTTP GET request
Creating a window
Reading critical registry keys
Creating a process with a hidden window
Connecting to a cryptocurrency mining pool
Launching the default Windows debugger (dwwin.exe)
Setting browser functions hooks
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun by creating a file
Unauthorized injection to a browser process
Malware family:
BlackNet RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d032b605-21c1-4ff1-adc8-684041972eca
Result
Threat name:
SmokeLoader Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/841564
Signature
Antivirus detection for dropped file
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
DNS related to crypt mining pools
Found C&C like URL pattern
Found strings related to Crypto-Mining
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Sample uses process hollowing technique
Sigma detected: Xmrig
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected SmokeLoader
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 473993 Sample: yNGNc3hC9Z Startdate: 30/08/2021 Architecture: WINDOWS Score: 100 71 193.56.146.67, 49732, 49733, 49742 LVLT-10753US unknown 2->71 73 127.0.0.1 unknown unknown 2->73 75 3 other IPs or domains 2->75 93 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->93 95 Sigma detected: Xmrig 2->95 97 Antivirus detection for dropped file 2->97 99 11 other signatures 2->99 10 yNGNc3hC9Z.exe 14 7 2->10         started        15 drfircc 2->15         started        17 svchost.exe 1 2->17         started        19 2 other processes 2->19 signatures3 process4 dnsIp5 87 moon-bot.org 82.146.63.123, 443, 49705, 49714 THEFIRST-ASRU Russian Federation 10->87 61 C:\Users\user\AppData\Local\Temp\verb.exe, PE32 10->61 dropped 63 C:\Users\user\AppData\...\yNGNc3hC9Z.exe.log, ASCII 10->63 dropped 65 C:\Users\user\AppData\Local\Temp\...\.dll, PE32+ 10->65 dropped 123 Tries to detect virtualization through RDTSC time measurements 10->123 21 verb.exe 10->21         started        125 Antivirus detection for dropped file 15->125 127 Machine Learning detection for dropped file 15->127 129 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 15->129 131 3 other signatures 15->131 file6 signatures7 process8 signatures9 101 Antivirus detection for dropped file 21->101 103 Machine Learning detection for dropped file 21->103 105 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 21->105 107 3 other signatures 21->107 24 explorer.exe 4 6 21->24 injected process10 dnsIp11 77 pizza-don.ru 37.230.114.90, 49712, 49721, 80 THEFIRST-ASRU Russian Federation 24->77 79 moon-bot.org 24->79 47 C:\Users\user\AppData\Roaming\drfircc, PE32 24->47 dropped 49 C:\Users\user\AppData\Local\Temp\6B4.exe, PE32 24->49 dropped 51 C:\Users\user\AppData\Local\Temp\106.exe, PE32 24->51 dropped 109 System process connects to network (likely due to code injection or exploit) 24->109 111 Benign windows process drops PE files 24->111 113 Injects code into the Windows Explorer (explorer.exe) 24->113 115 2 other signatures 24->115 29 106.exe 14 7 24->29         started        34 explorer.exe 8 24->34         started        36 6B4.exe 1 24->36         started        38 2 other processes 24->38 file12 signatures13 process14 dnsIp15 89 moon-bot.org 29->89 67 C:\Users\user\AppData\Local\Temp\Zenar.exe, PE32 29->67 dropped 69 C:\Users\user\AppData\Local\Temp\...\.dll, PE32+ 29->69 dropped 133 Tries to detect virtualization through RDTSC time measurements 29->133 40 Zenar.exe 29->40         started        91 pizza-don.ru 34->91 135 System process connects to network (likely due to code injection or exploit) 34->135 137 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 34->137 139 Tries to steal Mail credentials (via file access) 34->139 141 Tries to harvest and steal browser information (history, passwords, etc) 34->141 143 Uses schtasks.exe or at.exe to add and modify task schedules 36->143 145 Sample uses process hollowing technique 36->145 147 Injects a PE file into a foreign processes 36->147 45 conhost.exe 36->45         started        file16 signatures17 process18 dnsIp19 81 iplogger.org 88.99.66.31, 443, 49724, 49725 HETZNER-ASDE Germany 40->81 83 bitbucket.org 104.192.141.1, 443, 49726, 49739 AMAZON-02US United States 40->83 85 3 other IPs or domains 40->85 53 C:\ProgramData\Systemd\old.exe (copy), PE32+ 40->53 dropped 55 C:\ProgramData\Systemd\grid.exe, PE32+ 40->55 dropped 57 C:\ProgramData\Microsoft Network\System.exe, PE32 40->57 dropped 59 2 other malicious files 40->59 dropped 117 Multi AV Scanner detection for dropped file 40->117 119 May check the online IP address of the machine 40->119 121 Machine Learning detection for dropped file 40->121 file20 signatures21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07451b0c3aaa3d6dcb79a4ece6b59a5176226f234527ca810c8c50469a54d070/
Threat name:
ByteCode-MSIL.Trojan.Heracles
Create hunting rule
Status:
Malicious
First seen:
2021-08-30 01:13:30 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a5crwdb2vi6w3s3zutwonnm2kf3ce3zdiut4vaimrriengsu2bya._file
Verdict:
suspicious
Similar samples:
4088596950d2caffe223750d63f9b3ffd83aac1611748e82da11a244e90430d8
Kovter
68e731d3431bc9223c2ff57b2d319194c4a6b8027e15c75f16b841bc78499172
Kovter
716b373d586926bb42f955ed155ac900e1d19494150d0539f22225b03d47f424
Kovter
8e0fb8a88118787644f807d2c7d746cf2d35888aff6031a28888f024187f6d02
Kovter
cedead0402b84528a99183467e491dd9c106847eaa9090853ccf6fa522e1bb42
Kovter
dfa8a5144d89c3e1858c50b566bf1906e15491295cf5115d86b1d7209e15b557
Kovter
f4e1fc78ba0a65bde5687a67eb89e20166e062356b77227c9e0211060bd14dc8
Kovter
f4f845267f7126cfdfc8ca2aa6ebe1dd3833a74e393b1d0acf76cb33acb3e740
Kovter
f9ca14fcdffeb48b11ea026812ac0a7dc941f27e0c1384dc8e9b83b18de4c2a7
Kovter
+ 549 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader family:xmrig backdoor miner trojan
Link:
https://tria.ge/reports/210830-bqzqrthqdn/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Drops startup file
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
XMRig Miner Payload
SmokeLoader
xmrig
Malware Config
C2 Extraction:
http://pizza-don.ru/
http://gthdsqhtpthdysqljvty.space/
Unpacked files
SH256 hash:
55ff1e0a4e5866d565ceeb9baafac73fdcb4464160fc6c78104d935009935cd7
MD5 hash:
edd74be9723cdc6a5692954f0e51c9f3
SHA1 hash:
e9fb66ceee1ba4ce7e5b8271b3e1ed7cb9acf686
Link:
https://www.unpac.me/results/d365983e-9b38-4f0a-8186-4dd300590be4/
SH256 hash:
07451b0c3aaa3d6dcb79a4ece6b59a5176226f234527ca810c8c50469a54d070
MD5 hash:
46355d768d1028f7b95386d3ea309590
SHA1 hash:
902d28437c0e5322d79237f451cbd8dffe66bfc6
Link:
https://www.unpac.me/results/d365983e-9b38-4f0a-8186-4dd300590be4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/07451b0c3aaa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.95
Link:
https://yomi.yoroi.company/submissions/07451b0c3aaa3d6dcb79a4ece6b59a5176226f234527ca810c8c50469a54d070

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_AgileDotNet
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Agile.NET / CliSecure
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Kovter

Executable exe 07451b0c3aaa3d6dcb79a4ece6b59a5176226f234527ca810c8c50469a54d070

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/183753/
  
URLhaus
https://urlhaus.abuse.ch/url/1577708/

Comments


Avatar
zbet commented on 2021-08-30 12:54:19 UTC

url : hxxp://193.142.59.152/wp-blog/pics/verb.exe