MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 153a5a770e7594794ce3ac19121c1ad44edc6acdf4e4ae6d77adbd964ae6609e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Metamorfo

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	153a5a770e7594794ce3ac19121c1ad44edc6acdf4e4ae6d77adbd964ae6609e
SHA3-384 hash:	dacffa5fc292e6d121667097283d11a1aac26f001bd73440b3a0d9eaa7cb33b8d0940b7027fbcdabd14307afa3d156db
SHA1 hash:	463447cebcc99f38def02e4f18b39d9a6f6443de
MD5 hash:	019e6e6d55f1b1d1f884e13491d37170
humanhash:	mountain-ten-undress-oklahoma
File name:	NFE_6337.msi
Download:	download sample
Signature	Metamorfo Create hunting rule
File size:	576'000 bytes
First seen:	2022-02-08 17:29:42 UTC
Last seen:	2022-02-18 07:10:36 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	12288:PQ5bhfYBowv43bqKlRH1Vq9iyX7AbTMTN:45bZYBowvitjVqoA7AbT
Threatray	9 similar samples on MalwareBazaar
TLSH	T1A2C49E2172DAC936C87F06B06D3EC79A4669BD6447F2C4EB13C86D1E0DB39C15232E96
Reporter	abuse_ch
Tags:	MetaMorfo msi

Intelligence

File Origin

# of uploads :

# of downloads :

163

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/238433/

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

control.exe remote.exe shell32.dll update.exe

Link:

https://www.filescan.io/uploads/6202a8e34077c8b9a0226892/reports/8b29549b-1b31-424a-96ce-8799d0a3eac8/overview

Result

Verdict:

SUSPICIOUS

Link:

https://labs.inquest.net/dfi/sha256/153a5a770e7594794ce3ac19121c1ad44edc6acdf4e4ae6d77adbd964ae6609e

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/936279

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/153a5a770e7594794ce3ac19121c1ad44edc6acdf4e4ae6d77adbd964ae6609e/

Threat name:

Win32.Trojan.Ole2Sneaky

Status:

Malicious

First seen:

2022-02-08 17:30:15 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

11 of 28 (39.29%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cu5fu5yoowkhsthdvqmreha22rhny2wn6tsk43lxvw6zmsxgmcpa._file

Verdict:

suspicious

Metamorfo

23179a9183cb0c0d3e10bfbf6edd5b1d92244ea1ae3120bb008ac09cea59b217

Metamorfo

522db4e152583bbf8b7ae3690216acb186fd67f35046d25b2dfb088e6f4aac9d

Metamorfo

52b32d417e469fddb09b2a14747de6b8dcef327c8f5f76bcec79bc678be87c54

Metamorfo

59a3f7c8511f22a6e48ec6a8f058fefaa3c881c0577bde3cf3ba34ef5688990b

Metamorfo

aee732049a8e5aacf18d9b558e8fdeb099d0a4ea83249af1919aee9d6015d08e

Metamorfo

af5a401ad1b885562640ee6206f950bfb9f7de9ca3df0e43df834a8cdc9d6f56

Metamorfo

e30b091e3162eed18f8c1b6a69bb7a28a4c722128456ee36a326a79a3367f514

Metamorfo

ea6793e52d123e1381764d06e53d0fa77ef9172c16488090660bcf5bce1df03b

Metamorfo

Result

Malware family:

n/a

Score:

8/10

Tags:

persistence vmprotect

Link:

https://tria.ge/reports/220208-v271vacaf3/

Behaviour

NTFS ADS

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Drops file in Windows directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Adds Run key to start application

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

VMProtect packed file

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/153a5a770e75/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.