🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22ee7c8451266b59cb99ae2f237b4d6590a8fee93c7bed8e8892cd6387ced8df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.InstalleRex


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22ee7c8451266b59cb99ae2f237b4d6590a8fee93c7bed8e8892cd6387ced8df
SHA3-384 hash: 9f9b98edf83be625fa5ee5b8b2c551880d1d1f2bdda4f3c369ecbabea9b87b188beecbe3d95aa8cbba6a12f2547d67f4
SHA1 hash: 07d264028b5f8aa1d9571f622ee839802f9629ae
MD5 hash: 3be87dea2784c5678e5352bc9b8dd0b0
humanhash: kilo-oklahoma-asparagus-wyoming
File name:virussign.com_3be87dea2784c5678e5352bc9b8dd0b0
Download: download sample
Signature Adware.InstalleRex
Create hunting rule
File size:311'672 bytes
First seen:2022-07-15 14:39:56 UTC
Last seen:2024-07-24 12:10:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a8286b574ff850cd002ea6282d15aa40 (8 x Adware.InstalleRex, 2 x InstallRex)
ssdeep 6144:UrkG9uEo2S1YnQmCX492DkwNP3qpYFVd0/TCnBI/nIirDw5xzcJe3JOcQULEfcKT:Urkeu6/eIo420mB47ngH3JKVcKT
Threatray 2 similar samples on MalwareBazaar
TLSH T18E642203C6025667D9B42772DDE382339A33FE43E47005AA5AE296CF21697B6D10237F
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 92e0b496a2cada72 (11 x Adware.Generic, 6 x Adware.InstalleRex, 2 x Adware.Yantai)
Reporter KdssSupport
Tags:Adware.InstalleRex exe signed

Code Signing Certificate

Organisation:Ivan Kostin
Issuer:COMODO Code Signing CA 2
Algorithm:sha1WithRSAEncryption
Valid from:2013-08-25T00:00:00Z
Valid to:2014-08-25T23:59:59Z
Serial number: eb11d24ce6ddbbf752fe4dc3d683d2bf
Thumbprint Algorithm:SHA256
Thumbprint: 2efee9c8c1b16e7cc4af8745b55a8171597a85424f84987b32debb1bf3fba96c
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
KdssSupport
Uploaded with API

Intelligence

File Origin
# of uploads :
2
# of downloads :
147
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/289654/
Detection(s):
Win.Trojan.Antifw-173
Create hunting rule

Win.Adware.Agent-1388696
Create hunting rule

Win.Adware.Agent-1388697
Create hunting rule

Win.Trojan.Installerex-249
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Сreating synchronization primitives
Creating a window
Creating a file
Searching for the window
Delayed writing of the file
DNS request
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/25393/overview
Behaviour
MalwareBazaar
AntidebugCommonApi
SystemUptime
GetTempPath
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed pup
Link:
https://www.filescan.io/uploads/62d17c818dab2096b99eed15/reports/03d35007-717a-4310-851b-8f786b5bb2b9/overview
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b82c14f3-bf97-4b48-a617-416181d9709b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22ee7c8451266b59cb99ae2f237b4d6590a8fee93c7bed8e8892cd6387ced8df/
Threat name:
Win32.PUA.InstallRex
Create hunting rule
Status:
Malicious
First seen:
2013-11-22 11:01:00 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
25 of 25 (100.00%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=elxhzbcrezvvts4zvyxsg62nmwikr7xjhr563duislgwhb6o3dpq._file
Verdict:
malicious
Similar samples:
2b802605ece335f6ff05062be544b40fc7e939c69391fbbaa4e930f5d621d064
Adware.InstalleRex
ac29cedfbef21320ce5e76b0dc5240fcee35d79a1abf356532b96d58c9cbea71
Adware.InstalleRex
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/220715-r1v34scdfp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Checks installed software on the system
Maps connected drives based on registry
Loads dropped DLL
Unpacked files
SH256 hash:
ae81c483a4d96eebf55cabc6a0f559036085198c718bbb22e3a668a74b9011f4
MD5 hash:
565c73345f6362263e75e3f46e4cd4ed
SHA1 hash:
ff613793f01ba0cfdc160a59d12d87868e4b9ee4
Link:
https://www.unpac.me/results/d5869e67-dd53-43fd-820a-23db94bc5143/
SH256 hash:
4ef3808d4df664f1750ecf0b1e84cd290d0d044a42f48862d78f551299bd9b2b
MD5 hash:
abe24aac92b7d012979fb3446518628f
SHA1 hash:
91157b7e5eaa120eed03724e729cc1f7f2cc5f0c
Link:
https://www.unpac.me/results/d5869e67-dd53-43fd-820a-23db94bc5143/
SH256 hash:
14ed2a8c11369abb64d2984d959c2e740ba1fd818f636edd8f60fa39272accb8
MD5 hash:
2549da03bd024fd7117e87f0edeec347
SHA1 hash:
8ff37eb8baf73b1854d3634dd968c482016a85bb
Link:
https://www.unpac.me/results/d5869e67-dd53-43fd-820a-23db94bc5143/
SH256 hash:
22ee7c8451266b59cb99ae2f237b4d6590a8fee93c7bed8e8892cd6387ced8df
MD5 hash:
3be87dea2784c5678e5352bc9b8dd0b0
SHA1 hash:
07d264028b5f8aa1d9571f622ee839802f9629ae
Link:
https://www.unpac.me/results/d5869e67-dd53-43fd-820a-23db94bc5143/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.06
Link:
https://yomi.yoroi.company/submissions/22ee7c8451266b59cb99ae2f237b4d6590a8fee93c7bed8e8892cd6387ced8df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:PUP_InstallRex_AntiFWb
Create hunting rule
Author:Florian Roth
Description:Malware InstallRex / AntiFW

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Adware.InstalleRex

Executable exe 22ee7c8451266b59cb99ae2f237b4d6590a8fee93c7bed8e8892cd6387ced8df

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/289654/

Comments