MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f
SHA3-384 hash: ec59a7ca55c1ae87ef1e2769eb6d98ebcd6b93e62795934c6e7272af78fc95fca5f200db0db90180ca66685b686478b9
SHA1 hash: 6e8394a04aa35551437d91910c787bf2165c175b
MD5 hash: 001c1231f099ae2188df58798c2c32cf
humanhash: august-island-happy-beer
File name:0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f
Download: download sample
File size:3'630 bytes
First seen:2024-11-14 18:54:50 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/octet-stream
ssdeep 48:8y5awvdGxS+WrgbWyaisQ51xqovdJ9Aab:8y55d2lWkb1nssYobq
Threatray 9 similar samples on MalwareBazaar
TLSH T11D71F438EE980636D2B69634FDE5A113F53A7B02B72E4E4D01C246C1896301FA4EDE1E
Magika lnk
Reporter JAMESWT_WT
Tags:lnk sirnisirlo-online

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
IT IT
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.28759.LnkHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30777.LnkHeur.UNOFFICIAL
Create hunting rule

Lnk.Dropper.Agent-9982181-0
Create hunting rule

TwinWave.EvilLNK.LOLBinOddLookPSHELL.20220711.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.Guinnesses.20220719.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.KingForADaypshell.20231121.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=673647e34ca0f9db40c45eb3
Tags:
infosteal virus gates
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive lolbin masquerade mshta powershell
Link:
https://www.filescan.io/uploads/673647870448e79357517231/reports/eec1f388-3d44-4ebb-af8f-90783ff9eebd/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1555831
Signature
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Obfuscated command line found
Powershell drops PE file
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Suspicious MSHTA Child Process
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Uses an obfuscated file name to hide its real file extension (double extension)
Windows shortcut file (LNK) contains suspicious command line arguments
Windows shortcut file (LNK) starts blacklisted processes
Writes to foreign memory regions
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f/
Threat name:
Shortcut.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2024-11-13 21:09:18 UTC
File Type:
Binary
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bvqetir3yjfdqwmxybiu77bcvhamtotiduokyl3mwuatxl7o7zhq._file
Verdict:
malicious
Label(s):
finfisherrat
Create hunting rule
idatloader
Create hunting rule
Similar samples:
0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f
3bf4932e6121846f3303818932219f7984ac60196b65e4f62a796156923d556a
94ab177cc62af8c0fa1d2a0be6575db5bde69a52d126293e6a7fe5c01607597d
abe7cc92554b2defc6c336d5cafabe798f1f6c75076ccce897d6337fdbc42fd5
baa56e574d8deed445d0e58487add9d429d60bbb1b39943c581bcf50e9bd91d6
dc68a1446e829afa5c7e33f4dd2233e096a492bdf3a82eb0eeacfafb69bdecbf
error
Result
Malware family:
n/a
Score:
  10/10
Tags:
collection discovery execution spyware stealer
Link:
https://tria.ge/reports/241114-xkrnmssbjp/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
Malware Config
Dropper Extraction:
https://pub-5b9223b1b9e74a70be22a0816a8b7ead.r2.dev/123.hta
Malware family:
HijackLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0d6049a23bc2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:EXE_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies executable artefacts in shortcut (LNK) files.
Rule name:Long_RelativePath_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies shortcut (LNK) file with a long relative path. Might be used in an attempt to hide the path.
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:SUSP_LNK_PowerShell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to powershell inside an lnk file, which is suspicious

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://x.com/malwrhunterteam/status/1857108083052257719

Comments