MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f7c96ba9cbe4b3dd4b40bf027f9682162d38a019155202fc498f7ddd54ec9f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0f7c96ba9cbe4b3dd4b40bf027f9682162d38a019155202fc498f7ddd54ec9f8
SHA3-384 hash:	705d75973f101b214107002cfb0d48ff57e55a0fae2ca7f8e684a6f03ddec20cfcf32145ac72968999ae53c3127034f1
SHA1 hash:	8da0a9ea4dad2e9dac2d037227b4206c2d8d4d0c
MD5 hash:	6d0e1af201924cc2d29329463237957b
humanhash:	asparagus-aspen-washington-tennis
File name:	6d0e1af201924cc2d29329463237957b.exe
Download:	download sample
File size:	653'312 bytes
First seen:	2023-05-13 06:49:19 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8782517e36f7985d0bf5e74e708684c2 (1 x RedLineStealer, 1 x Loki)
ssdeep	6144:xWBZ7ITWIwCoJU/dWLZ2WU25eEhNIforC5PdGnMIuIJgl0qiUUtZDIYHeKsreodV:QBZ7Iy/rcyHrCfnsJ5UwDIY9VQTcj8
Threatray	9 similar samples on MalwareBazaar
TLSH	T12BD4C013E293EC60E7214776BE1EC6E4765EB9D0CE5977AF1254AE2F09700B1D122732
TrID	39.5% (.EXE) InstallShield setup (43053/19/16) 28.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 9.6% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	0020e0908c632100
Reporter	abuse_ch
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

233

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

6d0e1af201924cc2d29329463237957b.exe

Verdict:

Malicious activity

Analysis date:

2023-05-13 06:54:57 UTC

Tags:

installer

Link:

https://app.any.run/tasks/d248a066-f9eb-49eb-8267-a7b548fe0543

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/388860/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.66987185.26739.26128.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Rewriting of the hard drive's master boot record

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

exploit greyware packed zusy

Link:

https://www.filescan.io/uploads/645f331c531a5c501800fb39/reports/7e4992d2-597c-4cfa-ae70-f229d4ad355a/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/0f7c96ba9cbe4b3dd4b40bf027f9682162d38a019155202fc498f7ddd54ec9f8

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Pitou

Malware family:

Pitou

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d43fa6d8-101f-4079-b0de-63bb5838b62d

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1232067

Signature

Contains functionality to infect the boot sector

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0f7c96ba9cbe4b3dd4b40bf027f9682162d38a019155202fc498f7ddd54ec9f8/

ReversingLabs TitaniumCloud Win32.Trojan.Smokeloader

Threat name:

Win32.Trojan.Smokeloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-11 20:05:34 UTC

File Type:

PE (Exe)

Extracted files:

70

AV detection:

25 of 37 (67.57%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b56jnou4xzft3vfubpycp6liefrnhcqbsfksal6etd353vkozh4a._file

Threatray malicious

Verdict:

malicious

Similar samples:

0492bb7752122b4c35a9d914b96318401ec1c187739aea0231ea54e7cbeebc76

0c8fcb4201e67579906b7a3512f0f093297231ecad2b949a7b41d377f22b5d56

17745cf313048c8618b348f3ed48abf6dc440e956a33ffdb252e53d6c05062a4

1d231194ad5d77102a9f38140fbec3a519fb3db1158f3a02fb49372bfc68df30

46a218a16190914c66dbcdf1a8c0d35aa3d0bc246b6cf16075567c85340bd33f

9ba8c34276ce6c2a3f078cb22d358e0a8f386ac9e416223260d9d62873dbfbd2

d68839827fc159c514d91b76e31f3ec0f665a1e577433c11955acb5b4fce2057

ec01db119b9112e92b8acc27071933ab367494675236c782e4a89c2cf9198b1d

fefd79100bb22c2ab9b8c79b95128f28b59e11d0ab82495463c555b87ec6a97a

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

bootkit persistence

Link:

https://tria.ge/reports/230513-hlx5gsff89/

Behaviour

Writes to the Master Boot Record (MBR)

UnpacMe 2

Unpacked files

SH256 hash:

b1272de3f0fc0785efa4c692b4a1471c9b419dd93b7dcd4c9dc4fb6c09abc549

MD5 hash:

9872fdbffbdb3145dc372df17ee4fdde

SHA1 hash:

595ddab28edeae1793481367e495e8db4c329446

Link:

https://www.unpac.me/results/6886dd99-0634-4b1b-905c-5922796be0f5/

SH256 hash:

0f7c96ba9cbe4b3dd4b40bf027f9682162d38a019155202fc498f7ddd54ec9f8

MD5 hash:

6d0e1af201924cc2d29329463237957b

SHA1 hash:

8da0a9ea4dad2e9dac2d037227b4206c2d8d4d0c

Link:

https://www.unpac.me/results/6886dd99-0634-4b1b-905c-5922796be0f5/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0f7c96ba9cbe/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 0f7c96ba9cbe4b3dd4b40bf027f9682162d38a019155202fc498f7ddd54ec9f8

(this sample)

Cape

https://www.capesandbox.com/analysis/388860/

  

URLhaus

https://urlhaus.abuse.ch/url/2628134/

  

Delivery method

Distributed via web download