MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e2fb00f8ea7dd05c3380f1809a7f3326152c4dde3f79446f22f3f9c05d9d12f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e2fb00f8ea7dd05c3380f1809a7f3326152c4dde3f79446f22f3f9c05d9d12f
SHA3-384 hash: 5aee02514c1d20a06219da90f40ff879d7aeb357b19025e82346a5b56b826d017c4f3475c572f23a8dfa9ee7debb4608
SHA1 hash: b0785e4cab8e6b4606994d1aad6a9936527012ba
MD5 hash: 175d5e42a925185d216d84dc5f448769
humanhash: kansas-march-vermont-helium
File name:175d5e42a925185d216d84dc5f448769.exe
Download: download sample
File size:4'661'760 bytes
First seen:2023-03-03 15:28:59 UTC
Last seen:2023-03-03 17:33:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash adc8d05555d8c832390d0979319844ec
ssdeep 98304:8DCfl17FH1iw3Hpbjtt1P9j7AxM5HY2GEiGDf60ilqfX2:8Di17OCpt/P9ppxfDf60iQO
Threatray 7 similar samples on MalwareBazaar
TLSH T1CC26F19FBAA541A3F36BE93C7F706F327A50526642A34C06CF09C1E472819375DAD632
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
175d5e42a925185d216d84dc5f448769.exe
Verdict:
Suspicious activity
Analysis date:
2023-03-03 15:38:56 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3078691c-fcd6-4266-914d-2a4e1b9db703

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/371446/
Detection(s):
SecuriteInfo.com.Variant.Zusy.451803.25926.20402.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
DNS request
Searching for the window
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/64021248fa4a461fbd256caa/reports/9b9ade42-545c-4d92-8955-4a4aee2ad65c/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/0e2fb00f8ea7dd05c3380f1809a7f3326152c4dde3f79446f22f3f9c05d9d12f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a65b747d-b087-43dd-aaa2-85f7259c7695
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1186677
Signature
Allocates memory in foreign processes
Creates autostart registry keys with suspicious names
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 819552 Sample: W5RvbYrHmf.exe Startdate: 03/03/2023 Architecture: WINDOWS Score: 68 22 Multi AV Scanner detection for submitted file 2->22 24 Machine Learning detection for sample 2->24 7 W5RvbYrHmf.exe 1 2->7         started        10 Oracleregid.1991-06.com.microsoft-Type4.5.3.8.exe 2->10         started        process3 signatures4 26 Writes to foreign memory regions 7->26 28 Allocates memory in foreign processes 7->28 30 Injects a PE file into a foreign processes 7->30 12 AppLaunch.exe 1 5 7->12         started        16 conhost.exe 7->16         started        process5 file6 20 Oracleregid.1991-0...oft-Type4.5.3.8.exe, PE32+ 12->20 dropped 32 Creates autostart registry keys with suspicious names 12->32 18 Oracleregid.1991-06.com.microsoft-Type4.5.3.8.exe 12->18         started        signatures7 process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e2fb00f8ea7dd05c3380f1809a7f3326152c4dde3f79446f22f3f9c05d9d12f/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-03-02 23:09:02 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
20 of 25 (80.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=byx3ad4ou7oqlqzyb4matj7tgjqvfrg54p3zirxsf47zyboz2exq._file
Verdict:
malicious
Similar samples:
0aaaeeb2a4317258353d646cadba368cef0d2e477b3e559f656aff75a3a40946
2485066b0a47ef5a72bed598787fc60afa1e15727e0fcb987ba47c9e100a01b1
48b226bb739aac1a4f9d90b898aeae795dff4a2035ae2805b8a43ba11ddaa667
91b8833d045e42de89fceb8698a75cd45b3a1b45fc67d1115cf9a181d7ca100b
b9736626a522b3d6301ede70895f1ffbb592d88b2f9e7a9908797e0a0249b00c
c9716a41f6865025271a42553f3240810b678f89bffaa2a5c69a0576757947ab
d429c7f575a65bc5bb031d953315379f8a2b2bcd8bbb9c40b4a1f1d005a10370
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/230303-swxxksaa75/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
08432ac17db689970dc199c63bede89d9bf6be9e23d95f4c913080795ec35c03
MD5 hash:
8a1b6e24b5cb4603c315a977634cd970
SHA1 hash:
10266fb49a89f997c4da98cbb0c52156389147ed
Link:
https://www.unpac.me/results/5a11d524-ce85-4d81-9244-72587cb7055a/
SH256 hash:
0e2fb00f8ea7dd05c3380f1809a7f3326152c4dde3f79446f22f3f9c05d9d12f
MD5 hash:
175d5e42a925185d216d84dc5f448769
SHA1 hash:
b0785e4cab8e6b4606994d1aad6a9936527012ba
Link:
https://www.unpac.me/results/5a11d524-ce85-4d81-9244-72587cb7055a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0e2fb00f8ea7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0e2fb00f8ea7dd05c3380f1809a7f3326152c4dde3f79446f22f3f9c05d9d12f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:virustotal
Create hunting rule
Author:Tracel

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 0e2fb00f8ea7dd05c3380f1809a7f3326152c4dde3f79446f22f3f9c05d9d12f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2469977/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/371446/

Comments