MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 183f5f29ce8cbae2cffadc593c4ca83cb05420f90396aa6335a8323dfa06a7e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stop


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 183f5f29ce8cbae2cffadc593c4ca83cb05420f90396aa6335a8323dfa06a7e7
SHA3-384 hash: 72e79a9be185fc6373a550ba8b884ead7c381b2f2ddae9393a117c81e69d2b64aa0cd3096eed94b7597e455383fefc16
SHA1 hash: 2c59b2cf2f94f6bd02f8ab4baaf59a15fb838ac0
MD5 hash: 3f2f841f053938d8b03158cab7cc5aca
humanhash: football-glucose-idaho-cup
File name:3f2f841f053938d8b03158cab7cc5aca.exe
Download: download sample
Signature Stop
Create hunting rule
File size:715'776 bytes
First seen:2022-08-30 19:15:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash decbdbedc0627b2e9e8ce85b9d4aebeb (5 x RedLineStealer, 2 x GCleaner, 1 x ArkeiStealer)
ssdeep 12288:CwR2TyJ+f9kqdUree0oHZ6R2MWs5K+Y4wEeQjp+tG4Q2cdDNTOcV1Md96ok2bruK:CKlJSUr0qZ6R2Db7HFGV2ceckn6ovuWz
TLSH T155E4231132C3C07AF5D7A6B0A431C4B92EF608715B7614D71BAC092F8AB53D1AE763A7
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 480c1c4c4f590b14 (113 x Smoke Loader, 92 x RedLineStealer, 83 x Amadey)
Reporter abuse_ch
Tags:exe Stop


Avatar
abuse_ch
Stop C2:
http://116.202.180.202/

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection:
STOP
Create hunting rule
Link:
https://www.capesandbox.com/analysis/303390/
Detection(s):
Win.Malware.Dropperx-9965893-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/31892/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/630e636e3e9e50b1baede2e4/reports/e9e607c0-ac66-4446-ba80-c1b19c681391/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
STOP Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4b19c3f4-5449-4b74-8b19-eae0f70f118a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/183f5f29ce8cbae2cffadc593c4ca83cb05420f90396aa6335a8323dfa06a7e7/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-08-29 07:32:20 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=da7v6koors5oft723rmtytfihsyfiihzaolkuyzvvazd36qgu7tq._file
Result
Malware family:
djvu
Create hunting rule
Score:
  10/10
Tags:
family:djvu discovery persistence ransomware spyware stealer
Link:
https://tria.ge/reports/220830-xyvx8aefbj/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Detected Djvu ransomware
Djvu Ransomware
Malware Config
C2 Extraction:
http://acacaca.org/test1/get.php
Unpacked files
SH256 hash:
bd5114b7fcb628ba6f8c5c5d1d47fc7bb16214581079b3cc07273618b0c41fd8
MD5 hash:
2a41808217d5741e34ee4e7c71bc01cc
SHA1 hash:
8c6ff6f1baab749399afcba7b6bc58de102d1d06
Detections:
win_stop_auto
Create hunting rule
Link:
https://www.unpac.me/results/44b87ec4-f210-4db9-bd3c-1aa5f03d959a/
Parent samples :
8718c3fb8af937bc27504ff5eb70c3c0c73b6b5212b7ebdbc6fded506595e912
183f5f29ce8cbae2cffadc593c4ca83cb05420f90396aa6335a8323dfa06a7e7
06eb6a96195b9ba64669bfa166cd0422192f9f9d7bef186b31cc86b8cf84cbf0
a74b599ea12643a01a716a4e286d6ebbed6eddedfa82ed3215ba002f1081847c
SH256 hash:
183f5f29ce8cbae2cffadc593c4ca83cb05420f90396aa6335a8323dfa06a7e7
MD5 hash:
3f2f841f053938d8b03158cab7cc5aca
SHA1 hash:
2c59b2cf2f94f6bd02f8ab4baaf59a15fb838ac0
Link:
https://www.unpac.me/results/44b87ec4-f210-4db9-bd3c-1aa5f03d959a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/183f5f29ce8cbae2cffadc593c4ca83cb05420f90396aa6335a8323dfa06a7e7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_STOP
Create hunting rule
Author:ditekSHen
Description:Detects STOP ransomware
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:win_stop_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.stop.
Rule name:win_vidar_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.vidar.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/303390/

Comments