MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a440a4422a0d78491a519130614322102e5476a766ec538dbda5b416fae75d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a440a4422a0d78491a519130614322102e5476a766ec538dbda5b416fae75d3
SHA3-384 hash: d9cbf5e396318155ad1a5443099fc484a2db7f6fcd047657b7efae250a7733cff47ea42b49029aafe2a9888ed39761be
SHA1 hash: 38f53babba76fb636639f055eb61c17aab443b76
MD5 hash: aa1f18f8c041deb83721d53cc2f06a4b
humanhash: speaker-enemy-dakota-london
File name:aa1f18f8c041deb83721d53cc2f06a4b.exe
Download: download sample
File size:4'637'184 bytes
First seen:2023-03-03 15:29:01 UTC
Last seen:2023-03-03 17:33:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash adc8d05555d8c832390d0979319844ec
ssdeep 98304:oc31RBC96etJeZ3G9LWme1lZW03xLiSJOIQMEy8PyEpzVQa/H1YMlJ:p/+64JeBILWmeLw03dRJpP8PHb/HNJ
TLSH T1DC26F28FB5A941A3F36BF93C7F706F327A50526642934C0ACF09C1E4B2815775EA9632
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
aa1f18f8c041deb83721d53cc2f06a4b.exe
Verdict:
Malicious activity
Analysis date:
2023-03-03 15:36:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/aaf4e17c-4c20-4eea-9877-d68fe261e873

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/371447/
Detection(s):
SecuriteInfo.com.Variant.Zusy.451803.10206.26702.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for the window
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a file
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/640212495961badabfa97b9e/reports/d00ccaad-ebb7-4ac0-9ab3-079e4f255976/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/0a440a4422a0d78491a519130614322102e5476a766ec538dbda5b416fae75d3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8e3d9425-ceba-4e78-bd61-96268e139c03
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1186670
Signature
Allocates memory in foreign processes
Creates autostart registry keys with suspicious names
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 819551 Sample: S3JYfT669q.exe Startdate: 03/03/2023 Architecture: WINDOWS Score: 68 24 Multi AV Scanner detection for submitted file 2->24 26 Machine Learning detection for sample 2->26 7 S3JYfT669q.exe 1 2->7         started        10 SoftwareDistributionUSOPrivate-Type6.7.8.3.exe 2->10         started        12 SoftwareDistributionUSOPrivate-Type6.7.8.3.exe 2->12         started        process3 signatures4 28 Writes to foreign memory regions 7->28 30 Allocates memory in foreign processes 7->30 32 Injects a PE file into a foreign processes 7->32 14 AppLaunch.exe 1 6 7->14         started        18 conhost.exe 7->18         started        process5 file6 22 SoftwareDistributi...ate-Type6.7.8.3.exe, PE32+ 14->22 dropped 34 Creates autostart registry keys with suspicious names 14->34 20 SoftwareDistributionUSOPrivate-Type6.7.8.3.exe 14->20         started        signatures7 process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a440a4422a0d78491a519130614322102e5476a766ec538dbda5b416fae75d3/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-03-02 22:36:22 UTC
AV detection:
21 of 37 (56.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bjcaurbcudlyjenfdejqmfbseebokr3kozxmkog33jnuc35ooxjq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/230303-swxxkshe61/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
6a7cd45733de6f2c3ca6e7a26455324808337e689fe7ec06643fc50e26aa3837
MD5 hash:
8b740006f69d5dfa4f9c240a93c56fc9
SHA1 hash:
7f2779824d0a1d950c667dadb97a8579a44ad73c
Link:
https://www.unpac.me/results/981d6d93-8c13-4c71-a1e0-4f918aa6e466/
SH256 hash:
0a440a4422a0d78491a519130614322102e5476a766ec538dbda5b416fae75d3
MD5 hash:
aa1f18f8c041deb83721d53cc2f06a4b
SHA1 hash:
38f53babba76fb636639f055eb61c17aab443b76
Link:
https://www.unpac.me/results/981d6d93-8c13-4c71-a1e0-4f918aa6e466/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0a440a4422a0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a440a4422a0d78491a519130614322102e5476a766ec538dbda5b416fae75d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:virustotal
Create hunting rule
Author:Tracel

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 0a440a4422a0d78491a519130614322102e5476a766ec538dbda5b416fae75d3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2469977/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/371447/

Comments