MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 10cc2de88fbbbc389b48ba140b79bfdbce43173ab2ea5f7ed79b48314802646a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 10cc2de88fbbbc389b48ba140b79bfdbce43173ab2ea5f7ed79b48314802646a |
|---|---|
| SHA3-384 hash: | 8c09f73c146a602a19c87fbc836e350d156df0992e37a4b8a41e97f6c752ca083bda7a3762d6a18c84848422d66b3eb1 |
| SHA1 hash: | 8b77f5e6656230001989cc3d828aa43ce445aaac |
| MD5 hash: | d0cc2d9d58432cf09c6aac7856f75b93 |
| humanhash: | oven-johnny-tango-kilo |
| File name: | Nitro Generator - Linkvertise Downloader_X7-KHW1.exe |
| Download: | download sample |
| File size: | 2'705'872 bytes |
| First seen: | 2021-11-20 22:12:09 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5a594319a0d69dbc452e748bcf05892e (21 x ParallaxRAT, 20 x Gh0stRAT, 15 x NetSupport) |
| ssdeep | 49152:+qe3f6atzD7+H98AHaCfu60WmHCL+WuTmuKwEt:vSiwD7E9vButWmHCK5NKXt |
| Threatray | 179 similar samples on MalwareBazaar |
| TLSH | T144C5D03FB2EA6D7EC47A06394572929858376E70641A8CDA07FC250DCF27460BE3B715 |
| File icon (PE): |  |
| dhash icon | f87cb68aca92c9c8 (1 x Adware.Generic, 1 x Sality) |
| Reporter |  JaffaCakes118 |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Seebri - Linkvertise Downloader_JBUg-l1.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-18 17:51:02 UTC
Tags:
installer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
DNS request
Sending a custom TCP request
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
virus
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
evad
Score:
30 / 100
Signature
Multi AV Scanner detection for submitted file
Obfuscated command line found
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.OfferCore
Status:
Malicious
First seen:
2021-11-15 11:06:06 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 169 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Modifies system certificate store
Script User-Agent
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
8dc40627fa4c09f7fd6df78e3ad03d7db3767010e15418dba24e63754dcbc59b
MD5 hash:
74fad5c6cd2d3af1fa257b5e9531993a
SHA1 hash:
ab701031918456195cf9a12a8b33f9417a9f6496
SH256 hash:
10cc2de88fbbbc389b48ba140b79bfdbce43173ab2ea5f7ed79b48314802646a
MD5 hash:
d0cc2d9d58432cf09c6aac7856f75b93
SHA1 hash:
8b77f5e6656230001989cc3d828aa43ce445aaac
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 10cc2de88fbbbc389b48ba140b79bfdbce43173ab2ea5f7ed79b48314802646a
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.