MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23e3031465d1d82b6269870b0285007c37b4778b4260fbede19ef717959dabc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	23e3031465d1d82b6269870b0285007c37b4778b4260fbede19ef717959dabc7
SHA3-384 hash:	581a61e5d88670ac8ceb0c3ad0c9a26fe484b36a37a7a64919f8360701d46c2305587c28ee48ddc85ef5ed085ab78781
SHA1 hash:	8781e92eca63f64067312b128edd9753d5e63a51
MD5 hash:	b27992c6e5efd785ded3178f4f314012
humanhash:	mockingbird-london-football-xray
File name:	LoaderV2.exe
Download:	download sample
File size:	69'051'891 bytes
First seen:	2024-01-14 11:52:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (533 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	1572864:7rziNx5qjHaNtMQ3v8opFnEBMawX1MdGXYopMdzdeUIbf7:+x5qjHw1vsGd2YFMbUf7
TLSH	T1B1E7334A7C5D6862DA7634FCCB40803D6AB5B3B4DA37E061F03286D7BC5395B8C298D6
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
dhash icon	f0e8f0f0f0706810
Reporter	JaffaCakes118
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

494

Origin country :

RO

Vendor Threat Intelligence

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Searching for the window

Sending a custom TCP request

Сreating synchronization primitives

Creating a process from a recently created file

Creating a window

Creating a file

Running batch commands

Creating a process with a hidden window

Launching a process

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

DNS request

Reading critical registry keys

Unauthorized injection to a recently created process

Creating a file in the %AppData% subdirectories

Stealing user critical data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/65a3cb223b363792f359905d/reports/14aacda6-90bb-4515-88a6-d9e6ecef7943/overview

Hybrid Analysis Malware

Verdict:

Suspicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/23e3031465d1d82b6269870b0285007c37b4778b4260fbede19ef717959dabc7

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1374431

Signature

Antivirus detection for URL or domain

Drops large PE files

Sample is not signed and drops a device driver

Tries to harvest and steal browser information (history, passwords, etc)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

26%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/23e3031465d1d82b6269870b0285007c37b4778b4260fbede19ef717959dabc7

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eprqgfdf2hmcwytjq4fqfbiapq33i54lijqpx3pbt33rpfm5vpdq._file

Threatray unknown

Verdict:

unknown

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/240114-n2bjbahedj/

Behaviour

Enumerates processes with tasklist

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

An obfuscated cmd.exe command-line is typically used to evade detection.

Legitimate hosting services abused for malware hosting/C2

Executes dropped EXE

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.