MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b57f88dd88cf59b0f9aa09f1f4dd393c6b787f70afa9b6b111861d1a10af6a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1b57f88dd88cf59b0f9aa09f1f4dd393c6b787f70afa9b6b111861d1a10af6a7
SHA3-384 hash:	25abeb4c409f48fe30c5d1f9eb654713926900a276c07dc4aaab7e6abac1204dc4a1ad76615225a4a4b3912c6af9ee90
SHA1 hash:	a942df68847c6df93f96c8ad16bca1f4c730c95b
MD5 hash:	ba2d0a56acaf59c2eb46e0d5ca649c4e
humanhash:	alaska-red-alabama-fifteen
File name:	ba2d0a56acaf59c2eb46e0d5ca649c4e.exe
Download:	download sample
File size:	1'576'137 bytes
First seen:	2023-07-12 06:06:48 UTC
Last seen:	2023-07-12 06:43:22 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	fa8d20faea9ef7b4e2b7fbfe93442593 (17 x RedLineStealer, 4 x CoinMiner, 3 x AgentTesla)
ssdeep	49152:mDkUrjmjH1hLmabS8AtiPHIlKaVYELl1F0eUr98:m4UyH1hecwlAELlT0/8
Threatray	76 similar samples on MalwareBazaar
TLSH	T1FA751221BBD085B1E9E7187619F057717B3C7C302B698AEBA3582E0ECE305D0DA25797
TrID	91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) 0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	abuse_ch
Tags:	exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

248

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

ba2d0a56acaf59c2eb46e0d5ca649c4e.exe

Verdict:

Suspicious activity

Analysis date:

2023-07-12 06:16:22 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b441267d-cbf9-4861-86fe-c8d8c8a76ed2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/416266/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Uztuby.4.19274.32072.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Launching a process

Sending a custom TCP request

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

greyware lolbin overlay packed replace setupapi shdocvw shell32

Link:

https://www.filescan.io/uploads/64ae430a057bff26cf232a0c/reports/c2a4b2f5-e3f5-4737-9317-08b9ceed67ff/overview

Hybrid Analysis Win/malicious_confidence_90%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/1b57f88dd88cf59b0f9aa09f1f4dd393c6b787f70afa9b6b111861d1a10af6a7

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/dab2c117-58a0-4f0b-b52e-a8d3f792c2ef

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1271426

Signature

Machine Learning detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1b57f88dd88cf59b0f9aa09f1f4dd393c6b787f70afa9b6b111861d1a10af6a7/

ReversingLabs TitaniumCloud Win32.Trojan.Fauppod

Threat name:

Win32.Trojan.Fauppod

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-12 04:18:13 UTC

File Type:

PE (Exe)

Extracted files:

18

AV detection:

18 of 24 (75.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dnl7rdoyrt2zwd42ucpr6totspdlpb7xbl5jw2yrdbq5diik62tq._file

Threatray malicious

Verdict:

malicious

Similar samples:

2646dd01581c1813f0478a25051ca4edac5e5c4fedcbd1ac0b4ca758426ec52d

35bcfd69dcfa8a03e82c1141d1138e26a2779527ec631d6d5c2f66a217548e05

427b5d1b32a8e17b94097a085094afcf86e857dcc8db0fd0b4bf7c50e6f3f349

71a7be17ce0aa73dc1b2a2e353bc5ac7bc8e401f74c2681b4348650caf13d82b

b4c2ff718a6f5c872387c54960848ea4798b78ac9ea50928106cf66a4bdffeb1

cfb5c20ec8d95c35f7edb8743084d4491e43c62c575cf0102b4f6781c50689de

ec9c0d6142c588cb2f4c7c4142d3d4717120b722835b2315ce9c2a1d01d6fc10

f94d205032deabb7dd7caac10dfeb48eff041d15d985aa58ab2b96c1789b8c6d

+ 66 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230712-gvcpgacb42/

Behaviour

Modifies registry class

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

UnpacMe

Unpacked files

SH256 hash:

1b57f88dd88cf59b0f9aa09f1f4dd393c6b787f70afa9b6b111861d1a10af6a7

MD5 hash:

ba2d0a56acaf59c2eb46e0d5ca649c4e

SHA1 hash:

a942df68847c6df93f96c8ad16bca1f4c730c95b

Link:

https://www.unpac.me/results/6f342923-f6f9-4379-9260-86e027d6f47a/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/416266/