MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2451b15b1e0395d30f192de63344be36beb0cd9cd421ed2bc76c1ccb56778dfa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2451b15b1e0395d30f192de63344be36beb0cd9cd421ed2bc76c1ccb56778dfa
SHA3-384 hash: b29c4223c24f2af218977675133fe2bf8eb8af41fee41727932c0300cba62a38bdf43024379a477ff118e3bd5172d14e
SHA1 hash: e2bd0d82c5eeb28ae4b362327f29d3a9631b679b
MD5 hash: 8e4acc112536a345d361b47b9899d9b2
humanhash: shade-carpet-juliet-colorado
File name:8e4acc112536a345d361b47b9899d9b2
Download: download sample
File size:7'358'976 bytes
First seen:2022-12-09 16:02:33 UTC
Last seen:2022-12-09 18:30:03 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:aY3tkpAbK7ijaGhe/svdY8cD2/8CJJee3f76VoGJLkCTJ9vEC+rQd+G6xjYc44IY:VhkYCsvdnok8EcIW3zsdrpxUQ1kjEl
Threatray 200 similar samples on MalwareBazaar
TLSH T157763322B18EC937C5BE05B0792E431B81597E6087B394EBB3C82D5E1D739C1537AE86
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter zbetcheckin
Tags:msi

Intelligence

File Origin
# of uploads :
2
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/344759/
Detection(s):
SecuriteInfo.com.Win32.SpywareX-gen.26464.23387.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
shell32.dll
Link:
https://www.filescan.io/uploads/63935c389a505ad9423e82f9/reports/bff2705e-8643-4ff9-93d7-682571f2ff1b/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/2451b15b1e0395d30f192de63344be36beb0cd9cd421ed2bc76c1ccb56778dfa
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
3 / 100
Link:
https://www.joesandbox.com/analysis/1131548
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2451b15b1e0395d30f192de63344be36beb0cd9cd421ed2bc76c1ccb56778dfa/
Threat name:
Win32.Trojan.SpywareX
Create hunting rule
Status:
Malicious
First seen:
2022-12-09 16:03:20 UTC
File Type:
Binary (Archive)
Extracted files:
121
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eri3cwy6aok5gdyzfxtdgrf6g27lbtm42qq62k6hnqomwvtxrx5a._file
Verdict:
unknown
Similar samples:
220a3f00cbb5d2a2b78e8f1731bacc235163f2aa4999de6f0db3221bcb282801
793d375fd731665fe926913e74d7ddc360d5a31adbe2c7f3ff708ba9d6e2927d
8204f56c59f039bcdbe65589a4fe0b3a365c3979eb9a75992ebe0f191ee2740c
968540c083474982744f85646c34a3abf7299479e1156904691820d0d1c288ed
9b460d0214120b22911b0f436130a346b90e69307ade26a101d31835e1fdca12
9e2e6fe4472e5e0e7d4a9faf6eb9798fb72cf632a385a7c77528fb49a3931f5f
b324bf2765637c425eea72826c3a1524873fc8b2dc7c06cf9f5b3312bde8861a
d5879f5d5d3d9083d052faeb4bf23d2db047d259b5b00871e6e1a6b539cc8d74
df2f7dee20fb4b16fd8dbd026583c9669c60d772c0cb9b22bc0ef51bba45e69d
e64aacfe45af89033778c8149b059c7c5acc56a3a8a89b0695d22d770384eb6b
+ 190 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221209-thcj6agd41/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates connected drives
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.25
Link:
https://yomi.yoroi.company/submissions/2451b15b1e0395d30f192de63344be36beb0cd9cd421ed2bc76c1ccb56778dfa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi 2451b15b1e0395d30f192de63344be36beb0cd9cd421ed2bc76c1ccb56778dfa

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2452570/
Cape
Cape
https://www.capesandbox.com/analysis/344759/

Comments


Avatar
zbet commented on 2022-12-09 16:02:38 UTC

url : hxxps://bdc71w.dm.files.1drv.com/y4mJhpEXmQYuQAQYJmKW5CMvCtMvUk7jrMsDrCb_klFAOD6KjCAzLWH6Dp1QF1MW-xMjhmE87vdQVpFymxpjQ-PLSlIKgdzygmoPbZ_SBPkuf0VkzoS1p4niD8Ewq-T4RvOwErI5y0ii1aRCmBsBBXKQ5-5s-oXO0smtKpyfnw_s2p3R3RpZiUuFUTJk8-7Y_xnUigRi67Tehb5qlKZdD2rZA/Modulo%20de%20Seguran%C3%A7a.msi?download&psid=1