MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 166f42d9f5a77471c3537ad00e246c4e58e7e9b113e248799cd938467b2dddfc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 166f42d9f5a77471c3537ad00e246c4e58e7e9b113e248799cd938467b2dddfc
SHA3-384 hash: 4298f5363158d65e88d0a650c09a20c013800edea2eb0c69949b69227d2f0f42eef9b8352a248440d9728f484da423bc
SHA1 hash: edf51eb3667522825741918a24fedc398dd4ce54
MD5 hash: b10006163a7219e99b2049a680226d2a
humanhash: quebec-delta-coffee-four
File name:b10006163a7219e99b2049a680226d2a.exe
Download: download sample
File size:951'360 bytes
First seen:2021-10-29 16:49:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (864 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:KAOcZwXYQpJWTMTYMer8cn+BP1dHO3453ioO2R/YzVW:wNPWdr9GHOo5vOqt
Threatray 1'140 similar samples on MalwareBazaar
TLSH T1D7151202BAC2C572D57319321A3A97246E3DBC305E25DA2FB3A4696DDF351C19324BB3
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b10006163a7219e99b2049a680226d2a.exe
Verdict:
Malicious activity
Analysis date:
2021-10-29 17:35:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ff906103-5335-4df7-b736-27df8a8de6df

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Gen.Variant.Johnnie.221809.751.14920.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process from a recently created file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/cbe467f1-c53a-48d8-ac03-25e1b9136738
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/879426
Signature
Machine Learning detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 511860 Sample: OxoMaKoP4r.exe Startdate: 29/10/2021 Architecture: WINDOWS Score: 52 31 Multi AV Scanner detection for submitted file 2->31 9 OxoMaKoP4r.exe 1 13 2->9         started        process3 file4 25 C:\Users\user\AppData\Local\...\predebate.exe, PE32 9->25 dropped 12 cmd.exe 1 9->12         started        process5 process6 14 predebate.exe 12 12->14         started        17 conhost.exe 12->17         started        file7 27 C:\Users\user\AppData\Local\...\belated.exe, PE32 14->27 dropped 19 belated.exe 15 2 14->19         started        process8 dnsIp9 29 cdn.discordapp.com 162.159.134.233, 443, 49764, 49765 CLOUDFLARENETUS United States 19->29 33 Machine Learning detection for dropped file 19->33 23 WerFault.exe 23 9 19->23         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/166f42d9f5a77471c3537ad00e246c4e58e7e9b113e248799cd938467b2dddfc/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-10-29 16:50:06 UTC
AV detection:
6 of 45 (13.33%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
2d2f62269797be7ef763ac2da37e4c190381cfba8798e92e73ee9aa2084386f1
4ed0b0474741e959230eb8a17efbc5e0db94fba7f46499596dd6359b4cf16637
5a8b4dc95322eed89a2c77350395f8c1f79394369bebec84703ae285092a37f5
6109fdc0254cdefc1462dc6a453ecce1cd70d8b533822d3a11be42604eb47a18
940ad66c876976f4a05f12710687f5abb76443f693dd3986d1ff7a4c73fc866f
a64c1b956bb79c5cfec594165a4ba37e9f695f8f83ec2b7bc2729d19c2598cd5
c0503b9a911b674579a25005f552760d37b15e9246a8ccdae53d1e6001413611
c8a4462c6b8f5d8728d5374adc98def5a5c38dd97d70a1c3859c876bfbe3fbd0
e79ef9ac540330942b1185f71c77d95e6582ea77c4eedc0740a19afeebb59323
+ 1'130 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/211029-vb9rradfe7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
c8bc6f49ae3d2cb65e6117df1d90bf054363030e680d2e8aed9aee2dc8ad92b9
MD5 hash:
766bdc50bcb93dfafe085bcd17987578
SHA1 hash:
3d80548b7187a6d4637d4be228690b8fda313e17
Link:
https://www.unpac.me/results/639e8f35-0a9f-446c-9db5-7ed85de8384a/
SH256 hash:
166f42d9f5a77471c3537ad00e246c4e58e7e9b113e248799cd938467b2dddfc
MD5 hash:
b10006163a7219e99b2049a680226d2a
SHA1 hash:
edf51eb3667522825741918a24fedc398dd4ce54
Link:
https://www.unpac.me/results/639e8f35-0a9f-446c-9db5-7ed85de8384a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/166f42d9f5a77471c3537ad00e246c4e58e7e9b113e248799cd938467b2dddfc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 166f42d9f5a77471c3537ad00e246c4e58e7e9b113e248799cd938467b2dddfc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1727003/
  
Delivery method
Distributed via web download

Comments