MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12a23889a21d1682c204c2530270c5e80d0666f00382ee14bed50babf68daa83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12a23889a21d1682c204c2530270c5e80d0666f00382ee14bed50babf68daa83
SHA3-384 hash: 259d8b65c286f2240db119183b3ee168c47d74b87a9e29709b4253e06728bf397fe40cc29ab1f20bdc5ba8b6aa592d81
SHA1 hash: 90b4d409fc4c8c000c3429803db85d907ca1705f
MD5 hash: d2b015a4b49ccb92c3d4240769bb1841
humanhash: colorado-arizona-undress-network
File name:file
Download: download sample
File size:21'018'433 bytes
First seen:2022-12-28 01:46:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a6cec5b1a631d592d80900ab7e1de8df (3 x IRCbot, 3 x CobaltStrike, 3 x RedLineStealer)
ssdeep 393216:sflgwHGyvApWIzA9QsrloKn3e/m3pneWG2QXBv8SxRlJNW8J+FcjF:sflbmyvKWLqbdKnMv/RNW8JScjF
Threatray 59 similar samples on MalwareBazaar
TLSH T101273387B3450A99F495333BAC47952765F67C160BA4C29B41C81AA01EFB182FD7BF32
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon c6c2ccc4f4e0e0f8 (37 x PythonStealer, 21 x CrealStealer, 19 x Empyrean)
Reporter jstrosch
Tags:exe X64

Intelligence

File Origin
# of uploads :
1
# of downloads :
173
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-12-28 01:48:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5effcf0c-31ac-4905-b4c1-b18df1ade613

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Multi.Agent-CL.20191.24832.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Creating a file
Sending a custom TCP request
DNS request
Connecting to a non-recommended domain
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/63aba019a70bef46551bcdef/reports/ea38ecd0-056c-4b42-8a70-45c652c448b5/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
troj
Score:
27 / 100
Link:
https://www.joesandbox.com/analysis/1141856
Signature
Connects to a pastebin service (likely for C&C)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 774586 Sample: file.exe Startdate: 28/12/2022 Architecture: WINDOWS Score: 27 18 pastebin.com 2->18 24 Connects to a pastebin service (likely for C&C) 2->24 9 file.exe 501 2->9         started        signatures3 process4 process5 11 file.exe 3 9->11         started        dnsIp6 20 pastebin.com 104.20.67.143, 443, 49684, 49686 CLOUDFLARENETUS United States 11->20 22 104.20.68.143, 443, 49685, 49687 CLOUDFLARENETUS United States 11->22 14 cmd.exe 1 11->14         started        process7 process8 16 conhost.exe 14->16         started       
Gathering data
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-12-28 01:47:54 UTC
File Type:
PE+ (Exe)
Extracted files:
3242
AV detection:
11 of 26 (42.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ckrdrcncdulifqqeyjjqe4gf5agqmzxqaobo4ff62uf2x5unvkbq._file
Verdict:
unknown
Similar samples:
00e1e4b814a04c65c5592b51c1e74b7bb096b0b06cfdbbc03e71e54696546759
08da286f669199a5c2b131f66614bbb3718b159e48885f4a2b1c9af718256dd0
1a2a1a33841d79dcaf62dfd71becddec0581a725793fb6119f187568ac351794
20632d113408af16371070219ed4e9f260a3cc23db39fcddce2580ebf6669b5f
29a0ec2958b900db46598043791f3b672c7c62cf3d0ebd44444c208d057d05ce
61b16d71a76f83cef63d079b0735cd0a1cee24f1119063e28ef1f227f2bb27c4
6ae3599bcbb951c7fe73ab6060a654b5ced2e83cf3ff15038bec95743232425e
bb072637f15adf01881b15d6be17c943d912816b43cd843ca90089d56e638c0f
c6af2ec456ad02b9eb3faf9fd9384d3dc43a55e7b1a58eec4440ee4bde1e99ce
+ 49 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
pyinstaller upx
Link:
https://tria.ge/reports/221228-b7jqnahb66/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/12a23889a21d1682c204c2530270c5e80d0666f00382ee14bed50babf68daa83

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.
Rule name:shad0w_beacon_16June
Create hunting rule
Author:SBousseaden
Description:Shad0w beacon compressed
Reference:https://github.com/bats3c/shad0w

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 12a23889a21d1682c204c2530270c5e80d0666f00382ee14bed50babf68daa83

(this sample)

  
Delivery method
Distributed via web download

Comments