MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10456d7b2ebc60429fcc474c73b63c8855d15e78fdb917a35b1d029f24d14401. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments 1

SHA256 hash:	10456d7b2ebc60429fcc474c73b63c8855d15e78fdb917a35b1d029f24d14401
SHA3-384 hash:	b080770b3f6d776264b934c1ef6a4f173c97b70b2345f82de5d1542c927eaa868eac09a15f5863b83a872fe1cf7c027e
SHA1 hash:	f484de60ee9865c154362a88577f88d3b7affa72
MD5 hash:	75db06608f8db374abe0e44791443396
humanhash:	whiskey-cold-gee-johnny
File name:	75db06608f8db374abe0e44791443396
Download:	download sample
File size:	1'413'632 bytes
First seen:	2021-10-25 10:50:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a760781485268ad462242975d68411d5
ssdeep	24576:P/mj8gr6siw8y8KbE0N4TMAeulQI1N6y83bMJb2dtGulJe:POjH7iby84E0aTrlQcNkbYidv
Threatray	83 similar samples on MalwareBazaar
TLSH	T1B6657D4AA3A901E8D0ABD278CA52950BE7B17C0103709BDF17D95B5A1F23FE05E7E721
Reporter	zbetcheckin
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

189

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/199875/

Detection(s):

Win.Malware.Spyagent-9830839-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

fingerprint greyware

Link:

https://www.filescan.io/uploads/6176a39e9a5a1e91c5d20dd8/reports/30b44ad0-4c71-4226-8e2b-a9c485a8c053/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cc3cb91e-fb55-418c-ac6c-2e0515183751

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.spyw

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/876182

Signature

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/10456d7b2ebc60429fcc474c73b63c8855d15e78fdb917a35b1d029f24d14401/

Threat name:

Win64.Trojan.Fabookie

Status:

Malicious

First seen:

2021-10-22 00:52:16 UTC

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Verdict:

malicious

42de2be8dd54f0733138e13af44653c7acf129ab0acc376d89a18b2b8a69101e

4cd754af5d3b9faa7e9626f79fccc35464224247a10f4d01ef502a0423e637a7

8f8042ea48aa01dd010aede41cbfe28ba2741a9c0bc7b5c7b55d38e1ab3b5027

b22ea99c132ab236e3a9bcc4d42b9038badaaa85c14edfee535e21f7d46436a1

c03c8a4852301c1c54ed27ef130d0de4cdfb98584adef3dda2a096177016a18b

ccfd37710068b3998537ac325e29555ba9375ebf1230cf90e9dcf133e06bcdf3

d7b0380241e4d47fc00e72faa08831b51b0ae360d5ccc45717f39f3106c3020a

eae36eba857fac64d7b10f7055df67010c65bdf968734007462a9d6e2bdae47c

fd4d1fc83330c5cf818e557ef882ca147ba98fee4128fe00bda07c6c2f79050a

+ 73 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/211025-mxtzesghej/

Behaviour

Looks up external IP address via web service

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

10456d7b2ebc60429fcc474c73b63c8855d15e78fdb917a35b1d029f24d14401

MD5 hash:

75db06608f8db374abe0e44791443396

SHA1 hash:

f484de60ee9865c154362a88577f88d3b7affa72

Link:

https://www.unpac.me/results/6e1d4315-fd2d-4b00-98b7-b04ef0b21964/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/10456d7b2ebc60429fcc474c73b63c8855d15e78fdb917a35b1d029f24d14401

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 10456d7b2ebc60429fcc474c73b63c8855d15e78fdb917a35b1d029f24d14401

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1712308/

Cape

https://www.capesandbox.com/analysis/199875/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-10-25 10:50:36 UTC

url : hxxp://i.spesgrt.com/lqosko/p18j/cust2.exe