MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a9d93b4bb60ea97b92bad54c64357846be6df1adfd54cd521b1e0e424666b6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	1a9d93b4bb60ea97b92bad54c64357846be6df1adfd54cd521b1e0e424666b6e
SHA3-384 hash:	ca912d655cd3c67d3a17bf5e2f543e09072ed3058bc747761830d9238e878734724d0ddd06dfbb4bdfbc68088a54df75
SHA1 hash:	231cccb3f8df761448cc49464376c3345793ac73
MD5 hash:	38efc91b8c7e0c6405000a167a87109d
humanhash:	apart-eleven-tennessee-stairway
File name:	WindowShellExperinc.exe
Download:	download sample
File size:	6'144 bytes
First seen:	2022-11-11 07:09:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'753 x AgentTesla, 19'658 x Formbook, 12'249 x SnakeKeylogger)
ssdeep	96:XJ79WR7L1bhycLkaS5Nk92t1AYysqvk+dqyoVYd3ojmrl:p9WNL1bhyc9qNk92QYAvkVYdr
Threatray	10 similar samples on MalwareBazaar
TLSH	T195C1CC119EEF50DAF237073067EAB3B7126AF971452E71B874848A999F71A80CC11FB1
TrID	72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.4% (.EXE) Win64 Executable (generic) (10523/12/4) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	tcains1
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

156

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

WindowShellExperinc.exe

Verdict:

Suspicious activity

Analysis date:

2022-11-11 07:10:12 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/241be02b-df77-47a2-9bfc-e4a9d9688629

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/332316/

Detection(s):

SecuriteInfo.com.Variant.Marsilia.2083.20447.8693.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Launching a process

Creating a process with a hidden window

Creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/636df54c5ae98d577068bf13/reports/598469d3-3d8c-4f64-903f-79b3eae4f3eb/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/8d718963-7990-4477-a4e5-961dfdd76427

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1111070

Signature

Antivirus / Scanner detection for submitted sample

Encrypted powershell cmdline option found

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected MSILDownloaderGeneric

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1a9d93b4bb60ea97b92bad54c64357846be6df1adfd54cd521b1e0e424666b6e/

Threat name:

Win32.Trojan.Marsilia

Status:

Malicious

First seen:

2022-11-09 17:37:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 41 (60.98%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dkozhnf3mdvjpojlvvkmmq2xqrv6nxy237kuzvjbwhqoijdgnnxa._file

Verdict:

malicious

153a3ed551e0ab232e18446a4b185b3c3f4dbb45cfaab67aeed12ead3e8ac4b9

1eb20f517c0c3630095eeb0553390e906ee423dad7b5082a7b29a0243972b180

26a6102f08903f5ef1e86e7c112e65bd1f42e9628bfb56312d20aa666943667d

49eea8495e1c1e78b9be1c6875ebac9cb68376e181834a95ff0e408bf6f90b5c

8744ee78fd8ec700b2d27545ad32e1e28f38f07c272d61bbcb8cff147cfb9bda

8d5bbc1df6891d4e6d87702068fedfdccf2533e0fe6648aa12e62766cc20cb54

d79ce2dede3d6ebedc5be7388c9139fdcc0282a894b60af4220030d1dccf796a

fe5bef849559a2f89c3f9e5aa7c1ce81530e7670cbefd11bdfa3e829a3c35777

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/221111-hzc2gaabd2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/91916424-dc91-4d65-8d97-94dc911ec35e

Unpacked files

SH256 hash:

1a9d93b4bb60ea97b92bad54c64357846be6df1adfd54cd521b1e0e424666b6e

MD5 hash:

38efc91b8c7e0c6405000a167a87109d

SHA1 hash:

231cccb3f8df761448cc49464376c3345793ac73

Link:

https://www.unpac.me/results/97108d21-1f26-4a8c-9555-1c9568f910f0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1a9d93b4bb60ea97b92bad54c64357846be6df1adfd54cd521b1e0e424666b6e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_Encoded_Discord_Attachment_Oct21_1 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:	Internal Research