MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23b038034753de2b160a1039ad4f724f0cb75d57d0f73af56d592850c82a20cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23b038034753de2b160a1039ad4f724f0cb75d57d0f73af56d592850c82a20cb
SHA3-384 hash: ce57f95fd75d1f96b56529028f52b462a851d03c6d3b0839f29dd470b22b71f1cf64427c4db8c8ddb3b98ff3acb49ba7
SHA1 hash: ebe90b7d6f1758ec5ba37ac4790ea218b40acda6
MD5 hash: 55eef1be7b19e0f52556a646368aefc2
humanhash: floor-vegan-happy-finch
File name:55eef1be7b19e0f52556a646368aefc2.exe
Download: download sample
File size:5'560'102 bytes
First seen:2020-12-25 08:50:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be41bf7b8cc010b614bd36bbca606973 (195 x LummaStealer, 126 x DanaBot, 63 x Vidar)
ssdeep 98304:64ssADNRb/Pg1wOys1pF7ABheymQBji839ouyavTsfhVNIBSxHHQb3cmIg9yiB6c:RAPbMpiheTuj5ouyavQfh3IB6kTYK
Threatray 43 similar samples on MalwareBazaar
TLSH 514633C33154AD20E5870C39646AAED30766FC967D228C22775DFDDF087710AAB22B67
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
616
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/109413/
Detection(s):
SecuriteInfo.com.EXE.Obfus-4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Deleting a recently created file
Searching for analyzing tools
Searching for the window
Creating a file in the %AppData% subdirectories
DNS request
Sending an HTTP GET request
Creating a file
Sending a custom TCP request
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Launching a process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Cryptbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/570005
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Potentially malicious time measurement code found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Yara detected Cryptbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 334062 Sample: FjDABtNw44.exe Startdate: 25/12/2020 Architecture: WINDOWS Score: 100 48 Antivirus detection for URL or domain 2->48 50 Antivirus detection for dropped file 2->50 52 Multi AV Scanner detection for dropped file 2->52 54 10 other signatures 2->54 7 FjDABtNw44.exe 20 2->7         started        10 SmartClock.exe 2->10         started        13 SmartClock.exe 2->13         started        process3 file4 30 C:\Users\user\AppData\Local\...\vpn_ico.exe, PE32 7->30 dropped 32 C:\Users\user\AppData\Local\...\6_ico.exe, PE32 7->32 dropped 34 C:\Users\user\AppData\Local\...\4_ico.exe, PE32 7->34 dropped 36 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 7->36 dropped 15 4_ico.exe 4 7->15         started        19 vpn_ico.exe 3 20 7->19         started        22 6_ico.exe 3 7->22         started        62 Hides threads from debuggers 10->62 64 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->64 signatures5 process6 dnsIp7 38 C:\Users\user\AppData\...\SmartClock.exe, PE32 15->38 dropped 44 Hides threads from debuggers 15->44 46 Tries to detect sandboxes / dynamic malware analysis system (registry check) 15->46 24 SmartClock.exe 15->24         started        40 ip-api.com 208.95.112.1, 49718, 80 TUT-ASUS United States 19->40 27 wscript.exe 12 19->27         started        file8 signatures9 process10 dnsIp11 56 Hides threads from debuggers 24->56 58 Tries to detect sandboxes / dynamic malware analysis system (registry check) 24->58 42 iplogger.org 88.99.66.31, 443, 49719 HETZNER-ASDE Germany 27->42 60 System process connects to network (likely due to code injection or exploit) 27->60 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/23b038034753de2b160a1039ad4f724f0cb75d57d0f73af56d592850c82a20cb/
Threat name:
Win32.Trojan.Mamson
Create hunting rule
Status:
Malicious
First seen:
2020-12-24 18:40:14 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
37cb831726dc1877ea59cf5618e4fa224368bbd64a7047dec6fb554a6a17d4c2
6bfb41ac8df840797e06a7da047dd349e7c4dbf75804f4ef2f3a9eb06daa2e38
a06a77bd973a602f49aff3fa3a116c62d38f0e0c1842e9dca97531a68d1a3884
a356d92ade4d8d537ea6dfabe765d4cd2ff851faae1d4551b91e50b47aac216f
a95255b520f721b807650a1de5feeefab46054029386cd0ce57c81daa3ac0248
b87a93613d0004b0d07eb302e75cd7030cb2a4bf466e92cec234e0abd8e6e727
b99887f1364955d2872bedadab15a15a51429ec8aeb111859d50e24a9fd31342
c84d98524bf72eac034a406063c9d25b3bceb254d3d03f1d68e018320c2fb506
eca5123a9c6fac8fa6d93a9f12ed7009ab816177eeb100e5ff27c3b4ff79d4a2
f5acccf9cda0f0ff2063de3983bc8964b9020d30feff2e3a8b20800d3c4fe034
+ 33 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
discovery evasion spyware upx
Link:
https://tria.ge/reports/201225-befylspmn6/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks installed software on the system
Drops desktop.ini file(s)
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Drops startup file
Identifies Wine through registry keys
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Executes dropped EXE
UPX packed file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
23b038034753de2b160a1039ad4f724f0cb75d57d0f73af56d592850c82a20cb
MD5 hash:
55eef1be7b19e0f52556a646368aefc2
SHA1 hash:
ebe90b7d6f1758ec5ba37ac4790ea218b40acda6
Link:
https://www.unpac.me/results/570db7bf-40f5-43e9-aaf3-5f1ac4d26f42/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/23b038034753de2b160a1039ad4f724f0cb75d57d0f73af56d592850c82a20cb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 23b038034753de2b160a1039ad4f724f0cb75d57d0f73af56d592850c82a20cb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/941927/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/109413/

Comments