MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2049eb0f0d01c273b63f1c660f39258ba4119eed14ed3a817d7073adc4014254. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2049eb0f0d01c273b63f1c660f39258ba4119eed14ed3a817d7073adc4014254
SHA3-384 hash: 7e82244ed508f25f64c1e263d277f16d9f52f9f5a7fae7c8aca612806ce46a5e81d14734485481675e95135fe597abad
SHA1 hash: 66ca4729a7c99d1671703d12bd8e5a48e87afe76
MD5 hash: aaddb3f299af86eb0aacbef55aae3558
humanhash: december-johnny-mars-ack
File name:127_1648120494_8461.exe
Download: download sample
File size:224'768 bytes
First seen:2022-03-25 07:03:01 UTC
Last seen:2024-07-24 12:03:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:TlbDybQKvKbHCJ5mVmsWGcL3cxGtWMkm+REMcNZ6tGBtJJJ5HJJJ8jTyp9gYFgSZ:pbVRbHCLj7tkm+RE7KG5RBHc
Threatray 59 similar samples on MalwareBazaar
TLSH T11624A94DB15915AAC4ECABF402931A22CF769E47D46BEF8C2CD558813BF63883E1D5C2
Reporter JAMESWT_WT
Tags:exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
199
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/257522/
Detection(s):
SecuriteInfo.com.Trojan.ClipBankerNET.14.31166.31796.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Creating a file
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
DNS request
Sending a custom TCP request
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe obfuscated packed packed replace.exe schtasks.exe
Link:
https://www.filescan.io/uploads/623d692e1f2042394827427f/reports/d9b731aa-6966-46c0-b874-78cc2bd32748/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
EClipper
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/16f535eb-5113-4627-9ba6-ccc11debbe50
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/964387
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: File Created with System Process Name
Sigma detected: Silenttrinity Stager Msbuild Activity
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2049eb0f0d01c273b63f1c660f39258ba4119eed14ed3a817d7073adc4014254/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2022-03-25 06:48:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
10 of 42 (23.81%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
2395406485367f123c11e0ad5b8a1ce58638921fb7e7acfdd06e341135b2d8df
3db995ab386682dabab33188fd255f3930e4791bbfc7b9f494f365516e76ade1
6aa5078347357a441ef4427f92696b1d87bca4602c34ce794dbb051463e137f1
9617dc1938ef945ab37282b04d7d083412485c144dd60c96d68f508da8a1a7c1
aa18910412099ecf87968e2cf4b18088ecfe5311ace3a8f7b70612ce292063f7
b91e73e932fd097108875528989b0f29938b02af751c72a9e81b98757af60fab
fbe27506c78a9c364bdadfbdbcfe6c60a436aa3c06c0d83494ef4edda50cd93e
+ 49 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/220325-hvedqsbcb3/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Unpacked files
SH256 hash:
e245c4a7d41e095b5c5136a89e698bd11e452594d864e250607cff2b2efadbab
MD5 hash:
6c991f5490cd23d8df31d89864395b21
SHA1 hash:
a6e3fde5d6f72fce36c5a8955a6025d92efb4356
Link:
https://www.unpac.me/results/e4997704-4adb-4851-b0be-6ef59b68fd13/
SH256 hash:
ce492a9db9a6b83def6142933c45df73a8cb35dced59be92b7073f7cdb9b0985
MD5 hash:
8e1fd68643e6256d002c434d657dd576
SHA1 hash:
329776cde3cb33f70c333ea503da1513508dad32
Link:
https://www.unpac.me/results/e4997704-4adb-4851-b0be-6ef59b68fd13/
SH256 hash:
2049eb0f0d01c273b63f1c660f39258ba4119eed14ed3a817d7073adc4014254
MD5 hash:
aaddb3f299af86eb0aacbef55aae3558
SHA1 hash:
66ca4729a7c99d1671703d12bd8e5a48e87afe76
Link:
https://www.unpac.me/results/e4997704-4adb-4851-b0be-6ef59b68fd13/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/2049eb0f0d01/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.85
Link:
https://yomi.yoroi.company/submissions/2049eb0f0d01c273b63f1c660f39258ba4119eed14ed3a817d7073adc4014254

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/257522/

Comments