MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 204f9fbd3fb79151782fec13185b3c55e0109ad3e27e91fe1410cc1171106ff8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 204f9fbd3fb79151782fec13185b3c55e0109ad3e27e91fe1410cc1171106ff8
SHA3-384 hash: a650e4c58ee70c8f3ca1d9a71f3d2b72b4135fabdb17df2852d03a79e71ff832cc7744a83f6d8b2bf8ad73c9d3f13d73
SHA1 hash: 94dca78baa44dfbc0a95dd5b82565309ff20bf11
MD5 hash: c8eb4d9912947bf336aaf25e70ccd966
humanhash: angel-mango-florida-dakota
File name:UPDATED STATEMENT OF ACCOUNT (2).exe
Download: download sample
File size:478'208 bytes
First seen:2023-06-16 09:18:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:P5LbzIu9+r96fDF/Alp5l8NIb3cd0J5jFJKhBx:P5LA92/yHvMd0JJFJK
Threatray 2'817 similar samples on MalwareBazaar
TLSH T130A422395B168727D04F83F5AD202670877EE3C9B917CA934DD3B2E9DB41B220914D67
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter lowmal3
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
360
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
UPDATED STATEMENT OF ACCOUNT (2).exe
Verdict:
Malicious activity
Analysis date:
2023-06-16 09:20:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cd34bb36-d624-4883-9102-908459ebe7fb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/399424/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.32277.20482.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo jigsaw packed
Link:
https://www.filescan.io/uploads/648c28d0e8a7749a2a22531f/reports/29365db3-6b48-4770-8b85-f65303db00d8/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/204f9fbd3fb79151782fec13185b3c55e0109ad3e27e91fe1410cc1171106ff8
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/a194b8dc-bf37-4c27-a772-467a43db683a
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1255898
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 888914 Sample: UPDATED_STATEMENT_OF_ACCOUN... Startdate: 16/06/2023 Architecture: WINDOWS Score: 84 45 Sigma detected: Scheduled temp file as task from temp location 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 .NET source code contains potential unpacker 2->49 51 Machine Learning detection for sample 2->51 7 UPDATED_STATEMENT_OF_ACCOUNT_(2).exe 7 2->7         started        11 AzwcqLliYb.exe 5 2->11         started        process3 file4 37 C:\Users\user\AppData\...\AzwcqLliYb.exe, PE32 7->37 dropped 39 C:\Users\...\AzwcqLliYb.exe:Zone.Identifier, ASCII 7->39 dropped 41 C:\Users\user\AppData\Local\...\tmp3EFE.tmp, XML 7->41 dropped 43 UPDATED_STATEMENT_OF_ACCOUNT_(2).exe.log, ASCII 7->43 dropped 53 Uses schtasks.exe or at.exe to add and modify task schedules 7->53 55 Adds a directory exclusion to Windows Defender 7->55 13 powershell.exe 19 7->13         started        15 powershell.exe 21 7->15         started        17 schtasks.exe 1 7->17         started        25 5 other processes 7->25 57 Multi AV Scanner detection for dropped file 11->57 59 Machine Learning detection for dropped file 11->59 19 schtasks.exe 1 11->19         started        21 AzwcqLliYb.exe 11->21         started        23 AzwcqLliYb.exe 11->23         started        27 3 other processes 11->27 signatures5 process6 process7 29 conhost.exe 13->29         started        31 conhost.exe 15->31         started        33 conhost.exe 17->33         started        35 conhost.exe 19->35         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/204f9fbd3fb79151782fec13185b3c55e0109ad3e27e91fe1410cc1171106ff8/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-06-16 07:10:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ebhz7pj7w6ivc6bp5qjrqwz4kxqbbgwt4j7jd7qucdgbc4iqn74a._file
Verdict:
malicious
Similar samples:
0d8247c4ed6a49e33ac5d481f08cdef22d2ed7caf2434d031e0a0cebe296893d
12384caecb7a336ae37a29e642488b5cc45559c321dad21c4c8fa7868a2ce859
213c731aacc82ea20f97417a4adf5d4a024e52798d07f05b704711cb1f5c6248
4913dda08726dc0fcc3b36bb5daf24556364937a7c4950698e8f2cc0691aefc6
7cdadb18edcd84c6223b48a00dc074dfec26f8416b754acc87f1231ede8bc42c
82f14f2328af922009bb022e324ef028b09b2570981c3d98b2a29957829a0b0a
d4b09cfb630c5d4e123f5ea5076685911243496f62f489cf7a30479542096f35
d7abd39aef9b875bc280512418843d56e027212adfd34c36d7d20203168b8bad
e9104c6f82a1b8c52bb881161440b8b1a8e3bf358cd60672dbfc14a2bc12518d
+ 2'807 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230616-k9m1jaeb85/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Unpacked files
SH256 hash:
68539dcc9fc55cc76ee19c16cb9e26be165db6e3af63def47fdf21072da9de28
MD5 hash:
5ee62920ad00973f9fd67053761ccdc3
SHA1 hash:
f6591921ed8f2d44021f5b4994176f09fe9c0d5a
Link:
https://www.unpac.me/results/9d7bb59c-7d77-4c2f-9d87-20819618efb8/
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/9d7bb59c-7d77-4c2f-9d87-20819618efb8/
SH256 hash:
865f1472d7b02a86436022112bbc85e044b7931e56b8db6556d624294bfa95f5
MD5 hash:
b3da1af5fa7dd1fc04944a3a35c442c3
SHA1 hash:
d314e74cb34d543e82dbf9a204bddd77d57051c4
Link:
https://www.unpac.me/results/9d7bb59c-7d77-4c2f-9d87-20819618efb8/
SH256 hash:
b86193f0f5eeadf451f23596dffb4d015245311c67bc15244c2b1c81293d3679
MD5 hash:
be09d1a9fbdc7fe4ad47e49a0ccf2a0e
SHA1 hash:
3eea7d856de59fefd670110c2edda63c319a5a1b
Link:
https://www.unpac.me/results/9d7bb59c-7d77-4c2f-9d87-20819618efb8/
SH256 hash:
204f9fbd3fb79151782fec13185b3c55e0109ad3e27e91fe1410cc1171106ff8
MD5 hash:
c8eb4d9912947bf336aaf25e70ccd966
SHA1 hash:
94dca78baa44dfbc0a95dd5b82565309ff20bf11
Link:
https://www.unpac.me/results/9d7bb59c-7d77-4c2f-9d87-20819618efb8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/204f9fbd3fb79151782fec13185b3c55e0109ad3e27e91fe1410cc1171106ff8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Executable exe 204f9fbd3fb79151782fec13185b3c55e0109ad3e27e91fe1410cc1171106ff8

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/399424/

Comments