MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0df6eca30071051714c4d1b5bd16e11feb7a76ab208c907771d0dd470d91ab07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0df6eca30071051714c4d1b5bd16e11feb7a76ab208c907771d0dd470d91ab07
SHA3-384 hash: 772d962b922733604a81e2510964932768d443d2040f1c831e674294605b1aeb5c8e76ea5b7e0a61d97f4cf75d7ea89c
SHA1 hash: 063dc457d3a879769b118bde5e16816d58388912
MD5 hash: 3c445a0d0e7d96ebfba730db72bc8e37
humanhash: sweet-triple-april-asparagus
File name:BlueScreen.exe
Download: download sample
File size:7'731'386 bytes
First seen:2022-05-12 17:44:24 UTC
Last seen:2022-05-12 19:06:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0bbecc8e9f9f17b0ea9cc3899b15e5cf (1 x RedLineStealer, 1 x CortaBot, 1 x CobaltStrike)
ssdeep 196608:YmpFpsmvdsCncs4njQthsiHz8n27ki1Z+SwiAhAW/oBq:x3vaCncNnKhsx275Gj99
Threatray 24 similar samples on MalwareBazaar
TLSH T1CC763341B2A008B9E87B417D8817C639EA737C221316C65F17A9D7B73F532D2AE7E640
TrID 66.5% (.EXE) InstallShield setup (43053/19/16)
16.2% (.EXE) Win64 Executable (generic) (10523/12/4)
7.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.1% (.EXE) OS/2 Executable (generic) (2029/13)
3.0% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon aebc385c4ce0e8f8 (10 x PythonStealer, 7 x RedLineStealer, 7 x DCRat)
Reporter MichaelGalde
Tags:bluescreen exe Python

Intelligence

File Origin
# of uploads :
2
# of downloads :
337
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0df6eca30071051714c4d1b5bd16e11feb7a76ab208c907771d0dd470d91ab07.zip
Verdict:
No threats detected
Analysis date:
2022-05-13 06:05:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3b35b8b6-d0c9-4759-9f98-a0eea8b951bb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
PyInstaller
Create hunting rule
Link:
https://www.capesandbox.com/analysis/270165/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
BSOD occurred
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/17382/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
expand.exe greyware overlay packed python
Link:
https://www.filescan.io/uploads/627d47dd89dc6403e779e168/reports/924eb05a-af63-46cc-bbef-895ef05078e4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/32a90843-3303-4521-9b08-5d2be8b5137f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/993030
Signature
DLL reload attack detected
Multi AV Scanner detection for submitted file
Performs an instant shutdown (NtRaiseHardError)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0df6eca30071051714c4d1b5bd16e11feb7a76ab208c907771d0dd470d91ab07/
Verdict:
unknown
Similar samples:
04a31ae8a31bb4144d7392040442f4a38e8301cc550124cc47d012a0eba71bdd
414d8e74cdb96fe1e8742018494be41cdebd5c11804a30a7876a5bcd7bf01764
476a05d5c8ef4444f96cbd02c3a315c56227b7510f75e82249a449bb79e977fc
4b56d8713523dea09695ec6beef98608c234e5f8a9be77be931a687c080fb0f1
6e86ad43d7677a7d9a81ac9dd17df97703dfb49ee4456601b4fa2edd518ce0e5
a07afb3f48c05bc311adc6a9473310e6b35e14f14920e543ee8ca032a0af637f
f63f90decc7d763f3c5202c7a4c643aeb99fd1d85ca97d64bf77fc1cc733f9f9
ffc3d4c2d7568d3d632ba01f05fcb54bb8bc2b73afabc4741999957498011568
+ 14 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/220512-wbp8sahhem/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Loads dropped DLL
Unpacked files
SH256 hash:
0df6eca30071051714c4d1b5bd16e11feb7a76ab208c907771d0dd470d91ab07
MD5 hash:
3c445a0d0e7d96ebfba730db72bc8e37
SHA1 hash:
063dc457d3a879769b118bde5e16816d58388912
Link:
https://www.unpac.me/results/6ea2384b-c12a-4509-9938-4b0b1ee03268/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0df6eca30071051714c4d1b5bd16e11feb7a76ab208c907771d0dd470d91ab07

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/270165/

Comments