MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 191dee14873cffbbd7659eaccdecbec207c9abb6f0f8d09fca88f465078b547d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Zyklon


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 191dee14873cffbbd7659eaccdecbec207c9abb6f0f8d09fca88f465078b547d
SHA3-384 hash: da9e4b8a791c4876ccbf0989bc97190e519269f61ac633627e66b1db96389d80139effe8ee0f1b2cd5291505d9a3aa60
SHA1 hash: 3da18d116f60dd15d414d628cb172c49a695ef22
MD5 hash: fe0293bebd19d5a9bc1ff6cc5ed51825
humanhash: alabama-texas-mountain-lamp
File name:file
Download: download sample
Signature Zyklon
Create hunting rule
File size:3'462'656 bytes
First seen:2023-09-11 05:18:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:zkOVlxX1QX/aPViFGEz47ukfkyhn+4r0Sq5346HAP6BzUb:zNHxg/a0Hz4H+40fhhs6lu
TLSH T139F55B95BA814CB2CE5D12F1CD9217084ED5C4462328F2FB3AC781D9920DADB5BDF68B
TrID 40.9% (.EXE) Win64 Executable (generic) (10523/12/4)
19.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
8.0% (.ICL) Windows Icons Library (generic) (2059/9)
7.8% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 2f6d6d6d6d6c6d2f (1 x Zyklon)
Reporter andretavare5
Tags:exe Zyklon


Avatar
andretavare5
Sample downloaded from http://marrakechchoralmeeting.ma/netTime.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
292
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-09-11 05:21:12 UTC
Tags:
loader
Link:
https://app.any.run/tasks/42ee0f78-6cb0-4554-bde1-1edc46f9a8c2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/447820/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/191dee14873cffbbd7659eaccdecbec207c9abb6f0f8d09fca88f465078b547d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a89876b5-86ca-483d-a64f-a72246e1b212
Result
Threat name:
Phonk Miner, Xmrig
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1307039
Signature
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Drops large PE files
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Phonk Miner
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1307039 Sample: file.exe Startdate: 11/09/2023 Architecture: WINDOWS Score: 100 39 tradersteampoggx.space 2->39 45 Multi AV Scanner detection for domain / URL 2->45 47 Antivirus detection for URL or domain 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 3 other signatures 2->51 10 file.exe 5 2->10         started        14 JQSZY.exe 1 2->14         started        signatures3 process4 file5 37 C:\ProgramData\x64netJS\JQSZY.exe, PE32+ 10->37 dropped 57 Detected unpacking (changes PE section rights) 10->57 59 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->59 61 Drops large PE files 10->61 16 cmd.exe 1 10->16         started        19 cmd.exe 14->19         started        signatures6 process7 signatures8 43 Uses schtasks.exe or at.exe to add and modify task schedules 16->43 21 JQSZY.exe 14 5 16->21         started        25 conhost.exe 16->25         started        27 timeout.exe 1 16->27         started        29 conhost.exe 19->29         started        process9 dnsIp10 41 tradersteampoggx.space 179.43.170.230, 49726, 49727, 49728 PLI-ASCH Panama 21->41 53 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->53 55 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 21->55 31 cmd.exe 1 21->31         started        signatures11 process12 process13 33 conhost.exe 31->33         started        35 schtasks.exe 1 31->35         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/191dee14873cffbbd7659eaccdecbec207c9abb6f0f8d09fca88f465078b547d/
Threat name:
Win64.Trojan.CoinminerX
Create hunting rule
Status:
Malicious
First seen:
2023-09-10 16:30:40 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
100
AV detection:
20 of 23 (86.96%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=deo64fehht73xv3ft2wm33f6yid4tk5w6d4nbh6krd2gkb4lkr6q._file
Verdict:
suspicious
Label(s):
agenttesla
Create hunting rule
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230911-fzt9msdg4v/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Program crash
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
191dee14873cffbbd7659eaccdecbec207c9abb6f0f8d09fca88f465078b547d
MD5 hash:
fe0293bebd19d5a9bc1ff6cc5ed51825
SHA1 hash:
3da18d116f60dd15d414d628cb172c49a695ef22
Link:
https://www.unpac.me/results/7c7346c1-e673-4474-bbba-84e42e01864d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/191dee14873cffbbd7659eaccdecbec207c9abb6f0f8d09fca88f465078b547d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2710536/
Cape
Cape
https://www.capesandbox.com/analysis/447820/

Comments