MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2121bb382dba90ca0e780820eba937ea93bba1de1214ec4512bf7f4502037186. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2121bb382dba90ca0e780820eba937ea93bba1de1214ec4512bf7f4502037186
SHA3-384 hash: 7eb5d7a74846e95611f370bb1d428df12fc26f52ca89c405bd922d6caca94110517d1a93ef6925312b135831b3895a1e
SHA1 hash: c0780cfe1ce52bd8c87c73a4e2887a3f6981dde9
MD5 hash: b0a57b92cae07ae3cad328836c68e96b
humanhash: foxtrot-september-wisconsin-idaho
File name:file
Download: download sample
File size:2'311'997 bytes
First seen:2023-12-21 16:43:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1d0e3506c01cb61e9312cbea4911e92e
ssdeep 49152:UJGiWtEQM6lmdgfnmQaRyzFOmukuffX4gMUuxmQ2T+wSHSqrxShmVJyOBWJB:UIioEQJugfnfa85OUufnyxx2T+w1qrgn
Threatray 27 similar samples on MalwareBazaar
TLSH T122B533307FA346FAC7517871DDD64BF692F6DB1A43002B975780C6A9AD386CC9338688
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10523/12/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox)
Reporter andretavare5
Tags:exe


Avatar
andretavare5
Sample downloaded from https://DCFSDFDS2FDHFGJ.SBS/setup294.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/468828/
Detection(s):
Win.Packed.Babar-10011011-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
installer lolbin overlay packed sfx shell32
Link:
https://www.filescan.io/uploads/65846b54439457868c067e8b/reports/69ab0b6e-0ea7-42b8-af52-8baa7c903321/overview
Verdict:
Malicious
Labled as:
Packed.Babar
Link:
https://www.hybrid-analysis.com/sample/2121bb382dba90ca0e780820eba937ea93bba1de1214ec4512bf7f4502037186
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raspberry Robin
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1fe576c5-aa09-4ae6-8b5c-f917eaa0edfe
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1365682
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1365682 Sample: file.exe Startdate: 21/12/2023 Architecture: WINDOWS Score: 60 24 Multi AV Scanner detection for dropped file 2->24 26 Machine Learning detection for sample 2->26 28 Machine Learning detection for dropped file 2->28 9 file.exe 3 3 2->9         started        process3 file4 22 C:\Users\user\AppData\Local\...\Av5~k.CPl, PE32 9->22 dropped 12 control.exe 1 9->12         started        process5 process6 14 rundll32.exe 12->14         started        signatures7 32 Tries to detect sandboxes / dynamic malware analysis system (file name check) 14->32 17 rundll32.exe 14->17         started        process8 process9 19 rundll32.exe 17->19         started        signatures10 30 Tries to detect sandboxes / dynamic malware analysis system (file name check) 19->30
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2121bb382dba90ca0e780820eba937ea93bba1de1214ec4512bf7f4502037186
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2121bb382dba90ca0e780820eba937ea93bba1de1214ec4512bf7f4502037186/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2023-12-21 16:44:05 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
14 of 37 (37.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eeq3wobnxkimudtybaqoxkjx5kj3xio6cikoyrisx57ukaqdogda._file
Verdict:
malicious
Similar samples:
37c73cebda7805498c49208b40dadcc128b73d63966e887471b1feaba243c524
6978a4bd860bfbae8080738ed5419b73a3be8c69ba0ef5e80775f6b0660b59b2
70609a64a4e74a4f97720cebe3d62cf46bfeeef258db33cf1c2a045bc3307a45
8ab39e59baf8bf7f1ee737ee943baae0dee6b470c84cf67bd4faa67bc4ba7561
97dda84ad167e397c0fd4afb35a7f9e9432c4cc6059d4bb98c9742ae2dace984
+ 17 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231221-t8sztsbbek/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Unpacked files
SH256 hash:
2121bb382dba90ca0e780820eba937ea93bba1de1214ec4512bf7f4502037186
MD5 hash:
b0a57b92cae07ae3cad328836c68e96b
SHA1 hash:
c0780cfe1ce52bd8c87c73a4e2887a3f6981dde9
Link:
https://www.unpac.me/results/fd754d6d-20ee-4e36-afeb-4eac27f7bda3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2121bb382dba90ca0e780820eba937ea93bba1de1214ec4512bf7f4502037186

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/468828/
  
URLhaus
https://urlhaus.abuse.ch/url/2742922/

Comments