MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c5b80aed5a6781ee44add3021fdc566018cd342b6025a835a8ba053ed940e9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c5b80aed5a6781ee44add3021fdc566018cd342b6025a835a8ba053ed940e9e
SHA3-384 hash: 3585d8da92bde8990cd42c7b0ae9158bcfc2b88e3f475dca7e776de21d8e0f9e36be419ff4e243fe0ec0bda149cddc4a
SHA1 hash: 8cb53da115156e4c22ea33841060a360a0779ef2
MD5 hash: 72248e88976cdbe0e50872f2faa9d4c0
humanhash: juliet-eighteen-kilo-snake
File name:72248e88976cdbe0e50872f2faa9d4c0.exe
Download: download sample
File size:2'264'591 bytes
First seen:2023-10-07 07:36:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1d0e3506c01cb61e9312cbea4911e92e
ssdeep 49152:WfxEejd0K4xSFfra+wKcprurLvirPraVCDVpLuat/Z:W+Wd0K4xSFfra+MpruYPragBpLue/Z
Threatray 26 similar samples on MalwareBazaar
TLSH T1DAA53311BAE1C8F9E4030233996E337491D1C32ADF1549A367A88B8D2F75EC6C977627
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10523/12/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.23681.21749.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Running batch commands
Launching a process
Сreating synchronization primitives
Creating a process with a hidden window
Sending a custom TCP request
Gathering data
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/0c5b80aed5a6781ee44add3021fdc566018cd342b6025a835a8ba053ed940e9e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Emotet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d78a4766-533c-4193-b8d4-4ee6e2282630
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1321407
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1321407 Sample: IuBAZuoryB.exe Startdate: 07/10/2023 Architecture: WINDOWS Score: 68 29 Multi AV Scanner detection for dropped file 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 Machine Learning detection for sample 2->33 35 Machine Learning detection for dropped file 2->35 10 IuBAZuoryB.exe 3 2->10         started        process3 file4 27 C:\Users\user\AppData\Local\...\O8CXoI.tq, PE32 10->27 dropped 13 cmd.exe 1 10->13         started        process5 process6 15 control.exe 1 13->15         started        17 conhost.exe 13->17         started        process7 19 rundll32.exe 15->19         started        signatures8 37 Tries to detect sandboxes / dynamic malware analysis system (file name check) 19->37 22 rundll32.exe 19->22         started        process9 process10 24 rundll32.exe 22->24         started        signatures11 39 Tries to detect sandboxes / dynamic malware analysis system (file name check) 24->39
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0c5b80aed5a6781ee44add3021fdc566018cd342b6025a835a8ba053ed940e9e/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2023-10-06 01:45:18 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
20 of 37 (54.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=brnyblwvuz4b5zck3uycd7ofmyayzu2cwybfva22roqfh3mub2pa._file
Verdict:
malicious
Similar samples:
034fa11e0c8ac78fe39779a867f6f7189304b9a376ff16a0b51aea1cbb3c419d
088c8f0e3190144e9f10d5f100a713310b8cd52c0c1804f677e9e82afd302323
5d4111d129f9502329b4da06459f6bfbc4c55a9bd033d8cd4566cb4018887162
5da0e9654b321dbbf3fcddafb175f360658d859b9ee5e166b017818349e416ff
71cee2ccfe6e1198949c920b69503a096154b67c04569669f4597837d3ef1e69
84ab4814962af3d7f7e8927c20ced3f4c3cb5c6614e6e2bdb707318cf4499e11
863459003cb750f92ebb22dab8a6964b55244194c7f464db81c35b2359d7678d
b6c7f66593503ce7de53dec372a3407ab0c0ed221007eac96e44dd9b9488df0d
e7f0a03d34cf93e1dc0bc78b4d08436de180e22fada1628810873683b9b2ee73
eba06c3f9929f4c7faf7781e2eb438ceffa9836f7241606900eb6815ee46ff06
+ 16 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231007-jftqjshh3w/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Unpacked files
SH256 hash:
0c5b80aed5a6781ee44add3021fdc566018cd342b6025a835a8ba053ed940e9e
MD5 hash:
72248e88976cdbe0e50872f2faa9d4c0
SHA1 hash:
8cb53da115156e4c22ea33841060a360a0779ef2
Link:
https://www.unpac.me/results/c7e6245c-cfe4-4c15-ba08-7674b2249020/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0c5b80aed5a6781ee44add3021fdc566018cd342b6025a835a8ba053ed940e9e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 0c5b80aed5a6781ee44add3021fdc566018cd342b6025a835a8ba053ed940e9e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2715154/
  
Delivery method
Distributed via web download

Comments