MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e404aeb6c6fb5360901415bc80221dcd9c11ba2208edce84be331303ed4b9f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e404aeb6c6fb5360901415bc80221dcd9c11ba2208edce84be331303ed4b9f8
SHA3-384 hash: fba26b198c09d88120cca9ac9b8e478e9b62d22a422763ce37df45ce8c3b4d405cd5d49723bafd80f268b5185405b7e9
SHA1 hash: fcfe1c7565b61ece946f7b23a05b9cb69448ca90
MD5 hash: 6947be91375abbc5a1127730f5b8d023
humanhash: kansas-charlie-eight-alanine
File name:6947be91375abbc5a1127730f5b8d023.exe
Download: download sample
File size:385'024 bytes
First seen:2022-01-15 16:14:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a6e6b2eef299fc3b4c8a1d32f0111a23
ssdeep 6144:8LtTbntolOARGGzXDfQwUnS5Y4zdzbkOX7v40WcVrQQkCG2l3ftuiczkb:Ki98WzfRRRkI7gWV7Nl315p
TLSH T19184024D8F215A8BC7F426BE20867DFB43B09F17D5A035E29FB80E0A79B5091F11D929
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
289
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6947be91375abbc5a1127730f5b8d023.exe
Verdict:
No threats detected
Analysis date:
2022-01-15 16:17:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9132ad3e-d023-4e4c-b156-e71d862d612d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/219525/
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/4288/overview
Behaviour
MalwareBazaar
CPUID_Instruction
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug greyware
Link:
https://www.filescan.io/uploads/61e2f30cf2e8ec86fe027a2d/reports/d41c531c-00c7-4b6d-b52d-1fad8fd07a47/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ffa4616b-6926-4b3f-992e-878ed7827323
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/921219
Signature
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Trojan.Khalesi
Create hunting rule
Status:
Malicious
First seen:
2022-01-15 11:28:30 UTC
File Type:
PE (Exe)
AV detection:
10 of 28 (35.71%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/220115-tp8wyafbek/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
d10d293be8f19622b95558ba29c9bafae52ff8998496523876e9d82b8fccbcf9
MD5 hash:
579421d62be8f77933e1295c939a120f
SHA1 hash:
c3593256308c027203a4b84a6613a1435466c3a0
Link:
https://www.unpac.me/results/cf699dd6-43ab-4aa5-a5fe-678abf96583d/
SH256 hash:
0e404aeb6c6fb5360901415bc80221dcd9c11ba2208edce84be331303ed4b9f8
MD5 hash:
6947be91375abbc5a1127730f5b8d023
SHA1 hash:
fcfe1c7565b61ece946f7b23a05b9cb69448ca90
Link:
https://www.unpac.me/results/cf699dd6-43ab-4aa5-a5fe-678abf96583d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/0e404aeb6c6fb5360901415bc80221dcd9c11ba2208edce84be331303ed4b9f8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifcats referencing sandbox DLLs typically observed in sandbox evasion
Rule name:INDICATOR_SUSPICIOUS_References_SecTools
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many IR and analysis tools

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/219525/

Comments