MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bfa9407e8f01ad0ec04bfbacd98334f2bc4252c331ccc777357e98f9a13ee68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bfa9407e8f01ad0ec04bfbacd98334f2bc4252c331ccc777357e98f9a13ee68
SHA3-384 hash: 5c9eec6cb4425e07d8cff2a3ea14cb8585eb9a24b5d85995571795db35629f5991640b0da1121105c5d3fc602053d473
SHA1 hash: 93e4c0e59bf6ad7194bf23655b5c55384bd35070
MD5 hash: 07c66c8ea02c9ba5e4e06bb6cd01bd07
humanhash: pizza-shade-king-fourteen
File name:SWIFTCOPY-38492949.exe
Download: download sample
File size:327'511 bytes
First seen:2022-02-21 19:17:53 UTC
Last seen:2022-02-21 20:21:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 6144:AwXTREyq4huJnbaTQ9oRQTmuo6OStbGaomFciWm+aUMKg+:zTRw4hus37p6vtbjomFciWmjAT
Threatray 3'455 similar samples on MalwareBazaar
TLSH T1D06423C627D854B7D0E2C9338265D752D2BFD5081A930A2B8F744FBA38169CBCE325D2
File icon (PE):PE icon
dhash icon e4b2383c2ea6666c (1 x SnakeKeylogger)
Reporter James_inthe_box
Tags:exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
218
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/243038/
Detection(s):
SecuriteInfo.com.FakeAV.CXA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6213e571875593a3ccfd5fc0/reports/379daf7a-b659-47ea-94be-76c96502350b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4e7f62c3-f144-43da-9289-af28b0756c7e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/943448
Signature
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 575926 Sample: SWIFTCOPY-38492949.exe Startdate: 21/02/2022 Architecture: WINDOWS Score: 60 19 Multi AV Scanner detection for submitted file 2->19 21 Machine Learning detection for sample 2->21 7 SWIFTCOPY-38492949.exe 19 2->7         started        process3 file4 17 C:\Users\user\AppData\...\qczhtzlclf.exe, PE32 7->17 dropped 10 qczhtzlclf.exe 1 7->10         started        process5 signatures6 23 Multi AV Scanner detection for dropped file 10->23 13 WerFault.exe 23 9 10->13         started        15 conhost.exe 10->15         started        process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0bfa9407e8f01ad0ec04bfbacd98334f2bc4252c331ccc777357e98f9a13ee68/
Threat name:
Win32.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2022-02-21 19:17:19 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bp5jib7i6annb3aex65m3gbtj4v4ijjmgmomy53tk7uy7gqt5zua._file
Verdict:
malicious
Similar samples:
15ad64ff3dd6133508d70bd89f0be4390a286619ad3d085f22e07ee057da0c6f
2371fc811305f14278c9d0831966fc26c928a10453e8cf61afd98787c8ece126
31168981af16e0fc209774a91e04e5aaf622cacbed12e970b7a35db0705174d6
7096f1d2fd14899772fd59c0c7108372d4159ae301b5a790a83c3b42fd366b06
94517fa5a38b384136a3027f7588daa605494dd888e4658cb89d521f5fb2d55a
effd0df81d379a3d84ca32d0c345555636736d37c144475effb2d629f5d2eca1
fcccde6b56dbe8650273f1d67957a1adc1dd0e783d43d6543da7a44696731292
ff0b124c254ddf4b3bd11079d2475ff96a1b1e3e2ab6ffe4edbc7443c02c65df
+ 3'445 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/220221-xzyeqsbhak/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Loads dropped DLL
Executes dropped EXE
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
14f0e02bb43661f4f5328e1a92c0662854dbcfa70860dce4b15ebb04f1322a92
MD5 hash:
87d1a74782ac16053303efa769f1c385
SHA1 hash:
3cef2dabf32353ff07650e33a41a66a37d768d7f
Link:
https://www.unpac.me/results/fc38e772-9b84-4746-8ce2-27cff2fdaf75/
SH256 hash:
0bfa9407e8f01ad0ec04bfbacd98334f2bc4252c331ccc777357e98f9a13ee68
MD5 hash:
07c66c8ea02c9ba5e4e06bb6cd01bd07
SHA1 hash:
93e4c0e59bf6ad7194bf23655b5c55384bd35070
Link:
https://www.unpac.me/results/fc38e772-9b84-4746-8ce2-27cff2fdaf75/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.48
Link:
https://yomi.yoroi.company/submissions/0bfa9407e8f01ad0ec04bfbacd98334f2bc4252c331ccc777357e98f9a13ee68

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/243038/

Comments