MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 191466aeca83c112e4dd693d3355b068f78c46adb8d9d132d29eb10f68fcb00d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 191466aeca83c112e4dd693d3355b068f78c46adb8d9d132d29eb10f68fcb00d
SHA3-384 hash: c2a89ebe5d3347be7f90aafa81a34dea08793e5a85ba2bf57e4f815d071b143209613a8bf32b4974ab9340be0fa3ebe2
SHA1 hash: 9e2cca76b1e55b0fd2efe3646c28f3f40d224983
MD5 hash: 0056e6e4f6f215c189d6145834240f68
humanhash: hotel-stairway-batman-tennessee
File name:SecuriteInfo.com.Win32.PWSX-gen.31879.18695
Download: download sample
File size:34'816 bytes
First seen:2023-08-02 18:29:40 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 969ed979bcbb9cc9e109e354589ac767
ssdeep 768:c1CCRLQXVuvC2ei5c5z3Dmf+4nt0h6eE2AazMmxS27niPL0bbjt:c1CeOuvC2/W15JtkQSCn
Threatray 2'384 similar samples on MalwareBazaar
TLSH T149F21B20D6C1EEA6E4FA16FC8A77A524363A9D20C34940FF23C12D5E576C6C25E706E7
TrID 30.2% (.EXE) Win64 Executable (generic) (10523/12/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4505/5/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
330
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/439920/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.31879.18695.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware lolbin shell32
Link:
https://www.filescan.io/uploads/64caa0ac88dd49b8cef6f0f1/reports/54de69de-0173-4d24-a126-7f0cb7c01b96/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/191466aeca83c112e4dd693d3355b068f78c46adb8d9d132d29eb10f68fcb00d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/8bbbd0cb-e705-48c1-a5f4-f1ccf2d03607
Result
Threat name:
NSISDropper
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1284655
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected NSISDropper
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1284655 Sample: SecuriteInfo.com.Win32.PWSX... Startdate: 02/08/2023 Architecture: WINDOWS Score: 60 29 Multi AV Scanner detection for submitted file 2->29 31 Yara detected NSISDropper 2->31 33 Machine Learning detection for sample 2->33 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 8->10         started        12 cmd.exe 1 8->12         started        14 rundll32.exe 8->14         started        16 conhost.exe 8->16         started        process5 18 WerFault.exe 19 9 10->18         started        21 rundll32.exe 12->21         started        23 WerFault.exe 4 9 14->23         started        dnsIp6 27 192.168.2.1 unknown unknown 18->27 25 WerFault.exe 3 9 21->25         started        process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/191466aeca83c112e4dd693d3355b068f78c46adb8d9d132d29eb10f68fcb00d/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2023-08-02 15:56:53 UTC
File Type:
PE (Dll)
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dekgnlwkqparfzg5ne6tgvnqnd3yyrvnxdm5cmwst2yq62h4wagq._file
Verdict:
unknown
Similar samples:
02ef992b9a587c6cdc382995b5dcfff0367554ec581a6fa28d08c70444f9e0d9
10df744cf1f9de6cd6e2383d1be7c752773ad738aebdefb61034f51d64279244
190090b95e7c9b2410ceb2149bb1c4369550963e56693e331bda3d020a0018e2
1d3537a78980a2e078642e4e0370f71533154d0212ab9984219b78b6191e3c09
4d698a32de4877e432bf6d6af790d86746adb3bd352844451a7505fb3d8b3492
69b78313535ef2b6dc89c71b8c389907e8a02cccb5d9fdee05833d69aac84c0f
b06a8e80d889756ef8911732c42081cbeb224a37eb1cf75fa9b0607e2739698b
eb8e351b8fdaadf5429c19d052428ab81b91170406b937d0f3753e334a757fe3
f3256c298bef3b4070df894a2497eccb7619554966299f2a4c26fcf94b7d541d
f8254fb47869f88b6bac32008c47b3aaad33bfa1d15ccf7b09a243aa52476773
+ 2'374 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230802-w5ghqsab4y/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
191466aeca83c112e4dd693d3355b068f78c46adb8d9d132d29eb10f68fcb00d
MD5 hash:
0056e6e4f6f215c189d6145834240f68
SHA1 hash:
9e2cca76b1e55b0fd2efe3646c28f3f40d224983
Link:
https://www.unpac.me/results/87e51d25-0ef7-40a2-8a65-f0e2f0466d38/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/191466aeca83c112e4dd693d3355b068f78c46adb8d9d132d29eb10f68fcb00d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/439920/

Comments