MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14a10ef4f604c227bfa74bae7dd4b0ea95e27f0d1711080cd31efe6ab1141e95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14a10ef4f604c227bfa74bae7dd4b0ea95e27f0d1711080cd31efe6ab1141e95
SHA3-384 hash: 45a29e6043d0fb2c3412367425d5a904a1452afcee4b1aeb81331422d4886576b74e3977859761d4af8358f16d99bad4
SHA1 hash: fec99ee5b5e7d1e1f13ee69208292921a843a0bd
MD5 hash: 999d17f66b6e237453ad899d94fb6998
humanhash: hamper-autumn-april-lemon
File name:akt-sverka PDF.exe
Download: download sample
File size:322'560 bytes
First seen:2023-10-07 11:11:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:UD0AJsZbY+kdRpmXmfFgjYEIyv49iVt//Vzo+F0w3qmsTcKSK:K0AJ1+8RpmXmfFgjYEIyv49KnB5fiLS
Threatray 9 similar samples on MalwareBazaar
TLSH T132641919779A5915C35F4734E0B1644CEEF0CA17A3CAABAEAC0076F49CA37D0A6434E7
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter JAMESWT_WT
Tags:exe mod-bussines-ru payload

Intelligence

File Origin
# of uploads :
1
# of downloads :
283
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
rurat
Create hunting rule
ID:
1
File name:
akt-sverka PDF.exe
Verdict:
Malicious activity
Analysis date:
2023-10-07 12:28:30 UTC
Tags:
rat rurat redline
Link:
https://app.any.run/tasks/8c2e2f65-3c47-46bf-91d9-3a76d332ce3a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2429.20455.8033.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% directory
Restart of the analyzed sample
Creating a file
Searching for synchronization primitives
Using the Windows Management Instrumentation requests
Launching a process
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
lolbin packed replace
Link:
https://www.filescan.io/uploads/65213d0300484a1560038a48/reports/2ae6c57c-102c-49ad-b8fd-5d4859a0e693/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILMamut
Link:
https://www.hybrid-analysis.com/sample/14a10ef4f604c227bfa74bae7dd4b0ea95e27f0d1711080cd31efe6ab1141e95
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/26d2f482-18f4-4b9d-bc78-aa2d82f644f7
Result
Threat name:
RMSRemoteAdmin, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1321459
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Connects to many ports of the same IP (likely port scanning)
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
DLL side loading technique detected
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Sigma detected: Set autostart key via New-ItemProperty Cmdlet
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Costura Assembly Loader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1321459 Sample: akt-sverka_PDF.exe Startdate: 07/10/2023 Architecture: WINDOWS Score: 100 80 vip22gr.ru 2->80 82 vip23newtop.fun 2->82 84 3 other IPs or domains 2->84 96 Multi AV Scanner detection for domain / URL 2->96 98 Found malware configuration 2->98 100 Malicious sample detected (through community Yara rule) 2->100 102 13 other signatures 2->102 10 akt-sverka_PDF.exe 16 6 2->10         started        15 Wtvjsvqyeuy.exe 2->15         started        17 akt-sverka_PDF.exe 2->17         started        19 12 other processes 2->19 signatures3 process4 dnsIp5 88 mod-bussines.ru 31.31.196.239, 443, 49712, 49713 AS-REGRU Russian Federation 10->88 76 C:\Users\user\AppData\...\Wtvjsvqyeuy.exe, PE32 10->76 dropped 78 C:\Users\user\AppData\...\meta+rms031023.exe, PE32 10->78 dropped 126 Suspicious powershell command line found 10->126 128 Creates multiple autostart registry keys 10->128 130 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->130 21 meta+rms031023.exe 14 6 10->21         started        25 akt-sverka_PDF.exe 2 10->25         started        132 Multi AV Scanner detection for dropped file 15->132 134 Machine Learning detection for dropped file 15->134 136 Injects a PE file into a foreign processes 15->136 28 Wtvjsvqyeuy.exe 15->28         started        30 akt-sverka_PDF.exe 17->30         started        32 conhost.exe 17->32         started        138 Query firmware table information (likely to detect VMs) 19->138 140 Changes security center settings (notifications, updates, antivirus, firewall) 19->140 142 DLL side loading technique detected 19->142 34 wuapihost.exe 19->34         started        36 wuapihost.exe 19->36         started        38 Wtvjsvqyeuy.exe 19->38         started        40 2 other processes 19->40 file6 signatures7 process8 dnsIp9 72 C:\Users\user\AppData\Local\Temp\BUILD.exe, PE32 21->72 dropped 106 Multi AV Scanner detection for dropped file 21->106 108 Machine Learning detection for dropped file 21->108 110 Injects a PE file into a foreign processes 21->110 42 BUILD.exe 21->42         started        46 meta+rms031023.exe 21->46         started        86 5.75.169.94, 12853, 24598, 49714 HETZNER-ASDE Germany 25->86 112 Suspicious powershell command line found 25->112 114 Found many strings related to Crypto-Wallets (likely being stolen) 25->114 48 powershell.exe 25->48         started        116 Query firmware table information (likely to detect VMs) 34->116 file10 signatures11 process12 file13 74 C:\Users\user\AppData\Local\Temp\...\7z.exe, PE32 42->74 dropped 118 Multi AV Scanner detection for dropped file 42->118 120 Machine Learning detection for dropped file 42->120 50 7z.exe 42->50         started        54 Silverlight.Configuration.exe 42->54         started        122 Creates autostart registry keys with suspicious names 48->122 124 Creates multiple autostart registry keys 48->124 56 conhost.exe 48->56         started        signatures14 process15 file16 64 C:\ProgramData\SevenZip\wuapihost.exe, PE32 50->64 dropped 66 C:\ProgramData\SevenZip\ssleay32.dll, PE32 50->66 dropped 68 C:\ProgramData\SevenZip\msimg32.dll, PE32 50->68 dropped 70 2 other malicious files 50->70 dropped 104 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 50->104 58 conhost.exe 50->58         started        60 wuapihost.exe 54->60         started        signatures17 process18 dnsIp19 90 vip23newtop.fun 81.177.139.81, 49729, 49732, 49734 RTCOMM-ASRU Russian Federation 60->90 92 id.remoteutilities.com 64.20.61.146, 49725, 49775, 49777 IS-AS-1US United States 60->92 94 66.23.226.254, 49726, 49791, 5655 IS-AS-1US United States 60->94 144 Query firmware table information (likely to detect VMs) 60->144 146 Creates multiple autostart registry keys 60->146 signatures20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14a10ef4f604c227bfa74bae7dd4b0ea95e27f0d1711080cd31efe6ab1141e95/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2023-10-05 20:57:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=csqq55hwatbcpp5hjoxh3vfq5kk6e7ync4iqqdgtd37gvmiud2kq._file
Verdict:
malicious
Similar samples:
50fab7e7c50e5cded050887693996292a8e546064e8e69c8826ca8f8f7b03242
5a5405a59ac1371bf62ee9599b29bed6e7ee8e11f7319c6ff7d5900963900e3f
771ec2a2b691842fdb6ae7d67ec69d22911f2538120b522a0082038f2ce77aa9
790b64a5860a5069fedcb660efdffce2b5ab2195086100a6079697b662f0c198
91ad210dae91d724c701330e1ce8fd5047b8ee7a475d1dcc1474a812cab351ca
9858672b7c7fa3f8b4ef2ed4b8ab8686f1edfdc46a382ae6296051ac3b2742c3
b73234fec5a6cbf5e739a75ce9aa9674f11dd409a81c740f009e1bf18c767c94
b835220d18074195e2df569e8088470b7f400c334aef1dd54dfe30e2019dab7a
da316c99baf4e8e8e2df0d6d52a77774edb23a7375393a7b0b9414e8cb7b04a7
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/231007-natwksbb8v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Sets DLL path for service in the registry
Unpacked files
SH256 hash:
14a10ef4f604c227bfa74bae7dd4b0ea95e27f0d1711080cd31efe6ab1141e95
MD5 hash:
999d17f66b6e237453ad899d94fb6998
SHA1 hash:
fec99ee5b5e7d1e1f13ee69208292921a843a0bd
Link:
https://www.unpac.me/results/ad578737-0370-425e-8a8f-f256bd03f193/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/14a10ef4f604c227bfa74bae7dd4b0ea95e27f0d1711080cd31efe6ab1141e95

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments