MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ae99a454f6c11e30c346ca825e2d20bc5450ddb808f25dd20a4d952604d34f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GrandaMisha

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments 1

SHA256 hash:	1ae99a454f6c11e30c346ca825e2d20bc5450ddb808f25dd20a4d952604d34f0
SHA3-384 hash:	b23ff45743133adb8efccbb0115b8f66db7b10d977dbae7985a2dd77bc5aad3480481bf1e0562b868fdd9b358b52778a
SHA1 hash:	a6374884b5eb0cf5af44454b1db2fb7ff5af9d43
MD5 hash:	256ad62aa30b6dfb7755627698d31156
humanhash:	yellow-twelve-october-undress
File name:	256ad62aa30b6dfb7755627698d31156
Download:	download sample
Signature	GrandaMisha Create hunting rule
File size:	2'099'200 bytes
First seen:	2022-01-23 16:45:28 UTC
Last seen:	2022-01-27 13:55:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1232dc64de388ade9f0aa65d0636807d (4 x RedLineStealer, 2 x GrandaMisha, 1 x OnlyLogger)
ssdeep	49152:QLIDigVGaAvsh+ZVGKD0mKjd/oI5MkQAyf:AMvAdDt0dZ9QAy
Threatray	2 similar samples on MalwareBazaar
TLSH	T116A533617560C422C8A34DF14D23DFBA4F2D346028BA4A57B226631ADD773F08667B6F
File icon (PE):
dhash icon	fcfcb4b4b494d9c1 (74 x Amadey, 56 x Smoke Loader, 38 x RedLineStealer)
Reporter	zbetcheckin
Tags:	32 exe GrandaMisha

Intelligence

File Origin

# of uploads :

# of downloads :

223

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

256ad62aa30b6dfb7755627698d31156

Verdict:

Malicious activity

Analysis date:

2022-01-23 17:03:46 UTC

Tags:

evasion trojan

Link:

https://app.any.run/tasks/c6fecf81-c1c5-4611-9758-dbc23a311c0a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/221723/

Detection(s):

Win.Malware.Mikey-9917879-0

Win.Packed.Lockbit-9919158-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

DNS request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Sending a custom TCP request

Stealing user critical data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware mikey packed

Link:

https://www.filescan.io/uploads/61ed864fd32385db6322c9e7/reports/dc4ff08b-915d-4077-b6a0-495f47b888cb/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8f95fdcc-9f37-43d0-ae06-54ffda9ce737

Result

Threat name:

Unknown

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/925868

Signature

Antivirus detection for URL or domain

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1ae99a454f6c11e30c346ca825e2d20bc5450ddb808f25dd20a4d952604d34f0/

Threat name:

Win32.Trojan.Raccoon

Status:

Malicious

First seen:

2022-01-23 16:44:25 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 28 (82.14%)

Threat level:

5/5

Verdict:

malicious

GrandaMisha

c449bd8ac54c8c55b239bc43363edd87e9308c43d29d6cd9d55f6693da1e8170

GrandaMisha

Result

Malware family:

n/a

Score:

7/10

Tags:

collection spyware stealer

Link:

https://tria.ge/reports/220123-t9ylpsgbel/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads local data of messenger clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

9af802039a2d10a04472824411e07e2a5e41754ca9aaf087f461b1c36ce16195

MD5 hash:

b55156d602592488a125098d42e2dbb3

SHA1 hash:

b919d10c37e48e9274fae07a4e07289e96d88c6d

Link:

https://www.unpac.me/results/934abe1d-4efd-467a-8f00-0adc935edcf6/

SH256 hash:

1ae99a454f6c11e30c346ca825e2d20bc5450ddb808f25dd20a4d952604d34f0

MD5 hash:

256ad62aa30b6dfb7755627698d31156

SHA1 hash:

a6374884b5eb0cf5af44454b1db2fb7ff5af9d43

Link:

https://www.unpac.me/results/934abe1d-4efd-467a-8f00-0adc935edcf6/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1ae99a454f6c11e30c346ca825e2d20bc5450ddb808f25dd20a4d952604d34f0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers