MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c2417e5b0021682072cac8fbb09fbaf33fdddf5deaedca72e36b6bed4ce2cf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1c2417e5b0021682072cac8fbb09fbaf33fdddf5deaedca72e36b6bed4ce2cf0
SHA3-384 hash:	49ab377921670b5f27bcd5d394c7837eb5f1b9f68a671a2de30949f050e3918a69b3f6257e350a9ea323bf95327fad31
SHA1 hash:	d963665f8a9b4b09c9fe69a1ffbdb525c9017599
MD5 hash:	0311dcedadab9e8b70d67a5fdeb07cff
humanhash:	vermont-video-victor-summer
File name:	task
Download:	download sample
File size:	20'480 bytes
First seen:	2023-07-08 08:55:28 UTC
Last seen:	Never
File type:	unknown
MIME type:	text/plain
ssdeep	384:9uAntap+wBIoFwYV6XfHYjhpe6EityE70cP:sAkdI26PcpYiEE7d
TLSH	T185924C3A5D02FDD45FBE2E05A4442DA01CED7DA7A3F8A69CFE8508163DF9150CF254A8
Reporter	JAMESWT_WT
Tags:	cryptersandtools-minhacasa-tv

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

72

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Generic-EXE.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.PUA.Base64EXE-2.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/64a924a282e04d158394993d/reports/ebb16a87-5bba-4ffa-86b1-5eef61b31dbc/overview

Hybrid Analysis Barys.Generic

Verdict:

Malicious

Labled as:

Barys.Generic

Link:

https://www.hybrid-analysis.com/sample/1c2417e5b0021682072cac8fbb09fbaf33fdddf5deaedca72e36b6bed4ce2cf0

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded Powershell Directives

Detected one or more base64 encoded Powershell directives.

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1c2417e5b0021682072cac8fbb09fbaf33fdddf5deaedca72e36b6bed4ce2cf0/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.Barys

Threat name:

ByteCode-MSIL.Trojan.Barys

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-08 08:53:51 UTC

File Type:

Text

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dqsbpznqailiebzmvsh3wcp3v4z73xpv32xnzjzog23l5vgoftya._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1c2417e5b0021682072cac8fbb09fbaf33fdddf5deaedca72e36b6bed4ce2cf0