MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10d2012bd27f633c248587af6f7eb38302d757202a59f71b6aece282eac294df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10d2012bd27f633c248587af6f7eb38302d757202a59f71b6aece282eac294df
SHA3-384 hash: b5b82bf3d5864397bceba18d02e9f07c26985d2b534fe06d03e23dff02e254937f1c121aec587ccfa0a9185e1967e2c0
SHA1 hash: 6ddd3f2b5f38228d8ee87e5afef0b1e567944375
MD5 hash: 738daab8f14410ad4d68d4b65c89f31e
humanhash: bravo-oscar-eleven-maryland
File name:738daab8f14410ad4d68d4b65c89f31e
Download: download sample
File size:9'109'504 bytes
First seen:2021-06-11 06:40:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 196608:zQr6SHMTHsGTAUN769pC9xWgsPxurX1Sj/w0B0b:XiMTEUl63sqorFQ/wc0b
Threatray 16 similar samples on MalwareBazaar
TLSH 3796331AB34DA277D0F30DB8E69A4EA4522BAF29208114DD6025B7F4453278F73C7A77
Reporter zbetcheckin
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
738daab8f14410ad4d68d4b65c89f31e
Verdict:
No threats detected
Analysis date:
2021-06-11 06:42:24 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1b8263dd-469e-42d3-a39f-5f51b52d8f15

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/166019/
Detection(s):
SecuriteInfo.com.Malware.AI.3572669332.28010.21326.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8abb2018-6ecb-4735-adb2-c616115e7227
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/800665
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an undocumented autostart registry key
Injects a PE file into a foreign processes
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10d2012bd27f633c248587af6f7eb38302d757202a59f71b6aece282eac294df/
Threat name:
ByteCode-MSIL.Trojan.CrypterX
Create hunting rule
Status:
Malicious
First seen:
2021-06-11 06:41:09 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
2e14e2e4049c3ab737de85b2aec09298495717ecf076ca15c8ffb3eb9ce01833
4cbbee06b4d34bf93e14a630fd00ce24b513c6b930403845a493730f9f0af6a9
4ff2f77293b6804df81124399a416b304d7e778e5c6157bf1bd90f6e011f06d2
68997aa367d5b00e31b462a41dafe45cbe04b9b85ae70b4ffe7db107163f2f3f
6be657cf8e28f5473102498b6671c000cd0013bfa02c1dcc248925bd78f148dd
76f8eb1c233a5e3f94fe5bf42e28198b922b2957fcaf1c471c8e4fd5e59a2f80
9d8fd5f3d9a89980fb2d2353f23b54f2311d15a4e81fb7d906c2bebe587c4866
a2802bb969592412993d1c0d2c86f7054944166d5eaf8c1ec020f008e7eb2eb6
c1d8805a1d4e64b46121ec6b9b21225c26012a296632c58495d4dc8d845aba8d
f9284667090735eccb6110c4c9e33122890570b6f10798ef57370740c4d9db6d
+ 6 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/210611-pxr3j44xzx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
10d2012bd27f633c248587af6f7eb38302d757202a59f71b6aece282eac294df
MD5 hash:
738daab8f14410ad4d68d4b65c89f31e
SHA1 hash:
6ddd3f2b5f38228d8ee87e5afef0b1e567944375
Link:
https://www.unpac.me/results/f5803e9c-240b-434c-83c8-f188643bf682/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/10d2012bd27f633c248587af6f7eb38302d757202a59f71b6aece282eac294df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 10d2012bd27f633c248587af6f7eb38302d757202a59f71b6aece282eac294df

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1352736/
Cape
Cape
https://www.capesandbox.com/analysis/166019/

Comments