MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 076232500c999b75b351890a1d8230aba9a7423fcaff0825d1617473c85382e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OnlyLogger


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 076232500c999b75b351890a1d8230aba9a7423fcaff0825d1617473c85382e6
SHA3-384 hash: f94e5c5b8dfb1ca317d0158beed8925eb137f6f2737cff67550a7441c0696e1fc5473c6119356155ed36c392797ca35a
SHA1 hash: b4a80d27afeaa657f447e3f29fee80401543e4c6
MD5 hash: d1af82aa0fbd3220388af18c3eb26360
humanhash: london-ink-johnny-fix
File name:d1af82aa0fbd3220388af18c3eb26360.exe
Download: download sample
Signature OnlyLogger
Create hunting rule
File size:261'632 bytes
First seen:2023-10-02 18:00:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 93d103d7b72d447eca6f713c27a7a3a5 (4 x OnlyLogger, 2 x Smoke Loader, 2 x RedLineStealer)
ssdeep 6144:bLJwpp3Sdpr5k8FT1aQeXCAoyEjpcULaFoFqc:nJwP3gprq4aG3jfLAfc
Threatray 46 similar samples on MalwareBazaar
TLSH T16144E01135B1C431E6F7863A8836DFA46D7FB87269B0808F3314666E2E312D19B2975F
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 00010d48440c4c03 (1 x OnlyLogger)
Reporter abuse_ch
Tags:exe OnlyLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
290
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
OnlyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/452739/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/651b056200484a156000fbe8/reports/ea766651-9928-49ee-9c20-3bc03842bf6a/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/076232500c999b75b351890a1d8230aba9a7423fcaff0825d1617473c85382e6
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3a5c2501-06fa-4b03-995d-01ea37360d02
Result
Threat name:
onlyLogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1318199
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected onlyLogger
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/076232500c999b75b351890a1d8230aba9a7423fcaff0825d1617473c85382e6/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-10-01 15:45:27 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a5rdeuamtgnxlm2rrefb3arqvou2oqr7zl7qqjormf2hhsctqlta._file
Verdict:
malicious
Similar samples:
16b1a7cd37f26b787fa6bc8d87ca3fa2088c740feb7df95b8f7fe3a2b96b5113
OnlyLogger
1f6e1c0b0d5aa36e3eb96ec825979dd28708170c2fe1e726169361480b6d3693
OnlyLogger
578c111169f21fce527b0643847937dea9dc1d41035be05c104eaeceeb590132
OnlyLogger
5f3892f2aeaa6ac6f1c6b26d85cb50957381585376f4a23209c5d6c6219fc1bd
OnlyLogger
652ed9fea38372018ce53bcd4e7bcf562fa3446714fd894ab77ecbea7fe50b34
OnlyLogger
719fb7835d487d0614236063c966637e44681f6c1924ba4706c6d01a76fac8fe
OnlyLogger
98ec96ba074e1edbb26f8466ba001fb0a495f932878a2bf201da5f17424fe59f
OnlyLogger
9b2cd6f9d153ff961cfefc5a5fb538e9470fefb2ad19f516f64dc6bcea8245a8
OnlyLogger
af6e8f425fcb23cf384ca01f55ed5d1eb561b7ecbfa48264ecd8b51e460953f3
OnlyLogger
fd6995c5ee825d39df3c80ef4e14625534faa92c4e7650d862695b7e1e5516cd
OnlyLogger
+ 36 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231002-wlw43sfb56/
Behaviour
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Checks computer location settings
Deletes itself
Unpacked files
SH256 hash:
ba34c8ca4d21841ec006188cd061e81c0b22376799c8a22759d6bdbf0ddf066d
MD5 hash:
c8c88b356339a169e10864cb9d743cfd
SHA1 hash:
9c8f172444e1e545111fe15d0ad9c3cd425e13c2
Link:
https://www.unpac.me/results/bbd31962-59ce-4bfc-8c9e-802c49e4769f/
SH256 hash:
076232500c999b75b351890a1d8230aba9a7423fcaff0825d1617473c85382e6
MD5 hash:
d1af82aa0fbd3220388af18c3eb26360
SHA1 hash:
b4a80d27afeaa657f447e3f29fee80401543e4c6
Link:
https://www.unpac.me/results/bbd31962-59ce-4bfc-8c9e-802c49e4769f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/076232500c99/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/076232500c999b75b351890a1d8230aba9a7423fcaff0825d1617473c85382e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

OnlyLogger

Executable exe 076232500c999b75b351890a1d8230aba9a7423fcaff0825d1617473c85382e6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2714986/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/452739/

Comments