MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c735b8043168d9472b5dcc426e56f46c46e61a825b5a6fdb74389d6cb4daef5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c735b8043168d9472b5dcc426e56f46c46e61a825b5a6fdb74389d6cb4daef5
SHA3-384 hash: 167d763b934596e78c15d373084455ad9157418ab706d6bac4b5fa44f50073ad9a35526be27f076056fff7966fa9d108
SHA1 hash: 392cb2bf494119c4c42c49f8b01c6883a799564d
MD5 hash: 01395dcc1b4307263b40cfb8d1759575
humanhash: wisconsin-double-oscar-lamp
File name:Eclipsed Panel.exe
Download: download sample
File size:15'091'732 bytes
First seen:2022-04-18 05:44:50 UTC
Last seen:2022-04-20 10:23:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep 196608:F1MbBmzUkk8g9F7EYkkFD1lKXKKMr5glmjLuOipsttgmcnoOr9gFa8XO0x:FeSUtEHkFqXKKkqcmOiatemF9M8X9
Threatray 12'294 similar samples on MalwareBazaar
TLSH T15FE6BFF17E0AB2CFE19E09B4D55BCE47945C03F54F156902EC6E787EAE63C8122C6928
TrID 42.7% (.EXE) Win32 Executable (generic) (4505/5/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 61a4da68d2333371
Reporter adm1n_usa32
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
307
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Eclipsed Panel.exe
Verdict:
Malicious activity
Analysis date:
2022-04-18 05:41:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4f26bbf3-f717-4b1a-9d75-5c0cffd28d03

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
Creating a window
Creating a file in the %temp% subdirectories
Sending a custom TCP request
Сreating synchronization primitives
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/625cfae9eab80a7a6c356de4/reports/d641d78b-ea9e-49bc-aaa6-39787dded0ee/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e747d08c-eb81-448d-891a-17bc1f575340
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/978065
Signature
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c735b8043168d9472b5dcc426e56f46c46e61a825b5a6fdb74389d6cb4daef5/
Threat name:
Win32.Infostealer.Disco
Create hunting rule
Status:
Malicious
First seen:
2022-04-17 12:02:00 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
398cb27e45b7edad5322cbf38a9c39510bb9d8b3267b6d88d9cb1c53c575a6bb
480427092e1dbc18897a159dac8d98cfad92fb3eb2a16b90d75e0b5f75ba4568
52705396f93e5bf55c8f89fb3ff29bd0836ea1429c6d8f104d713448ca6a03a0
66c2d16720a324ba29f89aeabfeac44cceb594fae97684f6b903bec8b82fbf49
911860ba2f0c1d6b668bc865e77cdd09ef29682fa0ea39846b0affef39fa9e61
b75b694bdd2b87abd5edb0012cd46d25d62962caf00c60b59b6987d3956e3a73
+ 12'284 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion spyware stealer themida trojan
Link:
https://tria.ge/reports/220418-gfqyjscbaq/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks whether UAC is enabled
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
dcb842f5e0da9d486cad34d4b809dcaadf9ec4d6991fdb22bdc9aea66489ad1a
MD5 hash:
c02a029c978f13b753c6b578b1588c75
SHA1 hash:
e125d59451e7f467bfd329a00a506decbcd91d83
Link:
https://www.unpac.me/results/b63619c7-7877-4f8f-b493-dfb69da63c6a/
SH256 hash:
eea66dec92d6e3e76a182a989723f0772dfb91a4698dce94e9a237995f62dd18
MD5 hash:
a44983cb8bb2166003f7440cfc75ed57
SHA1 hash:
d001814ab0f0bb313323d0fdd94bf08987d35c70
Link:
https://www.unpac.me/results/b63619c7-7877-4f8f-b493-dfb69da63c6a/
SH256 hash:
77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
MD5 hash:
9af5eb006bb0bab7f226272d82c896c7
SHA1 hash:
c2a5bb42a5f08f4dc821be374b700652262308f0
Link:
https://www.unpac.me/results/b63619c7-7877-4f8f-b493-dfb69da63c6a/
SH256 hash:
5ab5aae30a73f39d027c2afda59e90410cef6cc2eddb172086b0ef47b3d1d897
MD5 hash:
fc41cd42f63851f55bda16ad21eaa941
SHA1 hash:
76a634e2a69cbd41c71a8b5e442af1ece0c07177
Link:
https://www.unpac.me/results/b63619c7-7877-4f8f-b493-dfb69da63c6a/
SH256 hash:
2ce85265f8441a547b6753881d1f6bff6076077441cdd4d958c9f41a2a05c74a
MD5 hash:
46b1896c52885e4b7b99abdbf13b7249
SHA1 hash:
7445e3f25d8037610ca7740faba645c55af9ca8b
Link:
https://www.unpac.me/results/b63619c7-7877-4f8f-b493-dfb69da63c6a/
SH256 hash:
e45f6b1ba7fc9723aec90b97cf7a33eb8106ac6a5af3a12927e1cef30c6c6347
MD5 hash:
3ef71d0ef13193723bef055f5f520549
SHA1 hash:
2532c8075840900dd86bea82f5ad1127c36afc46
Link:
https://www.unpac.me/results/b63619c7-7877-4f8f-b493-dfb69da63c6a/
SH256 hash:
1c735b8043168d9472b5dcc426e56f46c46e61a825b5a6fdb74389d6cb4daef5
MD5 hash:
01395dcc1b4307263b40cfb8d1759575
SHA1 hash:
392cb2bf494119c4c42c49f8b01c6883a799564d
Link:
https://www.unpac.me/results/b63619c7-7877-4f8f-b493-dfb69da63c6a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.66
Link:
https://yomi.yoroi.company/submissions/1c735b8043168d9472b5dcc426e56f46c46e61a825b5a6fdb74389d6cb4daef5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments