MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b0d56d493a542ea7f942f633afcf8af675ec8bd98ebea3788f73faa2019a9c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b0d56d493a542ea7f942f633afcf8af675ec8bd98ebea3788f73faa2019a9c1
SHA3-384 hash: 1f189c6bb480288315ab64b130b145bea52f8ca712b5b6b6d19de3547167fa3b808a29c56353d784c4825ba9e4b46ce3
SHA1 hash: 6bd245cbf4d532033d065c5a5315974c1ebf32e7
MD5 hash: 1d656300fb605f23bcaa01193720efe1
humanhash: artist-early-twelve-robin
File name:file
Download: download sample
File size:6'423'040 bytes
First seen:2022-11-16 21:21:00 UTC
Last seen:2022-11-16 22:45:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 29c17aa1f75d5ec7b02c9207993a6c14
ssdeep 98304:Nh+dbd33oSpsJu9oR+bY11UhoIwBOqF85EiqrvBb2s4U5OoNkI9xFvPrBtOshQa:j+BzpWu891ZDBOr+iqrpbTLp/8
TLSH T196562310B2599966E2139130882BC9F6432B7D7DDB4389B732D5BF4F3AB23D0417BA16
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 68d4aa888c8ac460 (2 x AgentTesla, 2 x SnakeKeylogger, 2 x AsyncRAT)
Reporter jstrosch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
230
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
No threats detected
Analysis date:
2022-11-16 21:30:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2351f7f9-d7af-4338-9754-01c27b81bae3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/335081/
Detection(s):
SecuriteInfo.com.Variant.Lazy.260895.1017.21979.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug greyware packed
Link:
https://www.filescan.io/uploads/637554494cfa4744015c6ae9/reports/c91ccb50-0cde-430e-aa1a-1755d7b35862/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/8f213e42-d8d7-4399-a889-326a102dcdb5
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1115312
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Machine Learning detection for sample
Modifies the windows firewall
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Potential dropper URLs found in powershell memory
Sample uses process hollowing technique
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 748009 Sample: file.exe Startdate: 16/11/2022 Architecture: WINDOWS Score: 100 76 Snort IDS alert for network traffic 2->76 78 Antivirus / Scanner detection for submitted sample 2->78 80 Machine Learning detection for sample 2->80 82 2 other signatures 2->82 8 file.exe 1 2->8         started        12 file.exe 2->12         started        14 file.exe 2->14         started        process3 file4 58 C:\WindowsbehaviorgraphoogleUpdate.exe, PE32 8->58 dropped 84 Encrypted powershell cmdline option found 8->84 86 Uses schtasks.exe or at.exe to add and modify task schedules 8->86 88 Writes to foreign memory regions 8->88 90 Injects a PE file into a foreign processes 8->90 16 GoogleUpdate.exe 8->16         started        19 GoogleUpdate.exe 12 8->19         started        22 powershell.exe 21 8->22         started        30 3 other processes 8->30 92 Drops executables to the windows directory (C:\Windows) and starts them 12->92 94 Allocates memory in foreign processes 12->94 96 Sample uses process hollowing technique 12->96 24 powershell.exe 22 12->24         started        26 schtasks.exe 1 12->26         started        28 schtasks.exe 1 12->28         started        32 2 other processes 12->32 signatures5 process6 dnsIp7 66 Detected unpacking (changes PE section rights) 16->66 68 Detected unpacking (overwrites its own PE header) 16->68 70 Uses netsh to modify the Windows network and firewall settings 16->70 74 2 other signatures 16->74 60 api.peer2profit.com 172.66.40.196, 443, 49704, 49706 CLOUDFLARENETUS United States 19->60 62 141.95.93.188, 443, 49705, 49707 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese Germany 19->62 64 192.168.2.1 unknown unknown 19->64 72 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 19->72 34 netsh.exe 3 19->34         started        36 netsh.exe 3 19->36         started        38 netsh.exe 3 19->38         started        40 conhost.exe 22->40         started        42 conhost.exe 24->42         started        44 conhost.exe 26->44         started        46 conhost.exe 28->46         started        50 3 other processes 30->50 48 conhost.exe 32->48         started        signatures8 process9 process10 52 conhost.exe 34->52         started        54 conhost.exe 36->54         started        56 conhost.exe 38->56         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b0d56d493a542ea7f942f633afcf8af675ec8bd98ebea3788f73faa2019a9c1/
Threat name:
Win32.Trojan.Lazy
Create hunting rule
Status:
Malicious
First seen:
2022-11-15 13:17:00 UTC
File Type:
PE (Exe)
Extracted files:
138
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dmgvnvetuvbou74uf5rtv7hyv5tv5sf5tdv6un4i6472uiazvhaq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
evasion vmprotect
Link:
https://tria.ge/reports/221116-z7bl2sha21/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Executes dropped EXE
Modifies Windows Firewall
VMProtect packed file
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6365cc5d-0462-4bd3-8eee-5bdd812591fd
Unpacked files
SH256 hash:
1b0d56d493a542ea7f942f633afcf8af675ec8bd98ebea3788f73faa2019a9c1
MD5 hash:
1d656300fb605f23bcaa01193720efe1
SHA1 hash:
6bd245cbf4d532033d065c5a5315974c1ebf32e7
Link:
https://www.unpac.me/results/26b7296a-85a7-4190-9173-106eea5f4253/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1b0d56d493a5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1b0d56d493a542ea7f942f633afcf8af675ec8bd98ebea3788f73faa2019a9c1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 1b0d56d493a542ea7f942f633afcf8af675ec8bd98ebea3788f73faa2019a9c1

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/335081/
  
URLhaus
https://urlhaus.abuse.ch/url/2422307/

Comments