MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a5e60319a443610bd184d1d0140036332d56430e32976e79c6aeec24be7d701. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Expiro


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a5e60319a443610bd184d1d0140036332d56430e32976e79c6aeec24be7d701
SHA3-384 hash: c41b7674ae924a3b64d6eab78d8f90b18aa55d958e608f788ac4a4635af4636a9255901ac76b39b2ddee58c8c779ff5c
SHA1 hash: 949677ee08e34c8a175222ba1dfad755acf4ba4f
MD5 hash: 8d2589de97506f3cd31d14dadb1a790c
humanhash: yellow-steak-uranus-nuts
File name:25% Bitcoin Interest.exe
Download: download sample
Signature Expiro
Create hunting rule
File size:597'504 bytes
First seen:2020-06-18 14:09:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:JYuLoKAWpr9PtYgtRToDadtp06L5Y4ujEaqLCPB4piht1KdS:OumWpr9FtRkDadJVY4ucCG4n
Threatray 146 similar samples on MalwareBazaar
TLSH 32D4121977E88714C5691B3ED5E600A443F5AA533922E32F3ECC335E28127E7968276F
Reporter James_inthe_box
Tags:exe Expiro

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Neshta
Create hunting rule
Link:
https://www.capesandbox.com/analysis/8726/
Detection(s):
SecuriteInfo.com.BehavesLike.Generic.fc.30295.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Infostealer.BitStealer
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 01:30:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
35 of 48 (72.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bjpgamm2iq3bbpiyjuoqcqadmmznkzbq4muxnz44nlxmes7h24aq._file
Verdict:
malicious
Similar samples:
057f4ea12c391a6fb346574383fb2a4feaf692e4bdb8383160b34672fdf239da
Expiro
143da9c82587966091a89e47a13083cbfa757699296e37b333ba607c7052dc8f
Expiro
313fc2bc689fcc4d9d0b191fa6107cf29dd9f56aba4b3ef2ad0b02e6a7596bf4
Expiro
319274d1c6c50850ea1fb7673c288c90b4df3420fd6362bac3fbfb93e3f1ea2d
Expiro
55ad97fb10fa268c55df83d0132b68c5f78424af1f5de8eefc29ed0263eb727a
Expiro
6e7b381441447157749ba664134682c01bad587614b29dab79aeab904419857d
Expiro
7b0c87e7c348aeeed116a9a82845a71ca123d99aa4748911f36e0e38d1a03797
Expiro
94c83300ebe3c3e2f911310692885aaf03f6d1df3a4c7ade24260f413989d78c
Expiro
b32e124d79e22d6fa01bea107ce49b5247629f4c4be8b27242887f2151d9ac31
Expiro
bf7ae4c4b3df671cb890a8814463ad46ec4d6edb6da0fe9c9201c1d3d9bec52d
Expiro
+ 136 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
spyware persistence
Link:
https://tria.ge/reports/200624-lznqwdc4wn/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Modifies system executable filetype association
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_neshta_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_neshta_g0
Create hunting rule
Author:gpalazolo
Description:This rule identifies Neshta Malware.
Reference:https://www.virusbulletin.com/virusbulletin/2014/08/bird-s-nest

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/8726/

Comments