MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24612d672e37bb6e47a89202b9a442b94eb7a353aa899746621c0c15389ab4f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24612d672e37bb6e47a89202b9a442b94eb7a353aa899746621c0c15389ab4f5
SHA3-384 hash: de117ee92cdc18b77b2607aeee92cc47290e90ae3012b0ca0df2a7ff6130941fde74d0d8a17c5c9d465d5bae055a4318
SHA1 hash: b71e7cfd0b60a0e1e86bd580fbd85085937523eb
MD5 hash: a10bc885cfabcc3a1b7094380822e6e5
humanhash: seventeen-network-xray-mars
File name:七月工资提成变动.exe
Download: download sample
File size:3'455'927 bytes
First seen:2023-07-03 08:01:24 UTC
Last seen:2023-07-03 08:03:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1ff847646487d56f85778df99ff3728a (4 x RedLineStealer, 3 x Nitol, 2 x Gh0stRAT)
ssdeep 98304:O06FOznLo0+Dd6uxcD6qlOPF7rJ3kwhN3:O3F6n80W6uG2q27Vkwj
Threatray 25 similar samples on MalwareBazaar
TLSH T1A0F52345F362C4B1D46781B488918B66CB733C225775C2DB1BE5AA7F2F233D09A36326
TrID 68.0% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
10.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
9.1% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
3.6% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon fadadac2a2b8c4e4 (11 x Nitol, 2 x Amadey, 2 x AgentTesla)
Reporter obfusor
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
243
Origin country :
HK HK
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
七月工资提成变动.exe
Verdict:
No threats detected
Analysis date:
2023-07-03 08:03:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5e6be207-06ec-4e6f-8614-8fa9dbf7c2fc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/405742/
Detection(s):
MiscreantPunch.SingleXOR.EXE.7.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.BackDoor.IRC.Bot.4560.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for synchronization primitives
Creating a window
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/95185/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
EvasionGetTickCount
Gathering data
Verdict:
Malicious
Labled as:
TR/Farfli.ssymd
Link:
https://www.hybrid-analysis.com/sample/24612d672e37bb6e47a89202b9a442b94eb7a353aa899746621c0c15389ab4f5
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/91c2f757-cfc4-4d64-81f0-93ecafb3e351
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1265620
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 898651 Sample: #U4e03#U6708#U5de5#U8d44#U6... Startdate: 03/07/2023 Architecture: WINDOWS Score: 48 46 Multi AV Scanner detection for submitted file 2->46 8 #U4e03#U6708#U5de5#U8d44#U63d0#U6210#U53d8#U52a8.exe 4 2->8         started        process3 file4 32 C:\Users\user\AppData\Local\...\lua5.1.dll, PE32 8->32 dropped 34 C:\Users\user\AppData\Local\...\irsetup.exe, PE32 8->34 dropped 11 irsetup.exe 22 8->11         started        process5 dnsIp6 44 192.168.2.1 unknown unknown 11->44 36 C:\un.exe, PE32+ 11->36 dropped 38 C:\Program Files (x86)\...\wdswfsafe.exe, PE32 11->38 dropped 40 C:\Program Files (x86)\...\wdsandbox.exe, PE32 11->40 dropped 42 C:\Program Files (x86)\...\360Win7Shield.exe, PE32 11->42 dropped 15 iusb3mon.exe 8 11->15         started        17 un.exe 5 11->17         started        20 un.exe 3 11->20         started        file7 process8 file9 22 WerFault.exe 24 9 15->22         started        24 WerFault.exe 2 9 15->24         started        30 C:\Microsoft\iusb3mon.exe, PE32 17->30 dropped 26 conhost.exe 17->26         started        28 conhost.exe 20->28         started        process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24612d672e37bb6e47a89202b9a442b94eb7a353aa899746621c0c15389ab4f5/
Threat name:
Win32.Backdoor.Farfli
Create hunting rule
Status:
Malicious
First seen:
2023-07-03 03:06:28 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
12 of 37 (32.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=erqs2zzog65w4r5isibltjccxfhlpi2tvkezortcdqgbkoe2wt2q._file
Verdict:
unknown
Similar samples:
02a8afb13fb3fa71b1607c1c878322ab3894d6e3d646ac17782339cc6065ce45
1c60192be3d193617aadd61be5be552a5b24e46e50492b04eb889ed1f6fbd81d
1e7ed9a8dd2e513ace96352932af722d1c3c88641b97f8f59a50774ef1dc31ea
61d451ce5a169591bd4e8633c9030a8afb54027e66dbae6127984caa48bc2568
827349ef926486d692dec5158ac66fcc27ec6f628f759f1cb23814f50f93ab88
86e69b16379a3aa41a658af413ea71364341da11e2f7d724dcefeac6eaa504ec
ac2776e3263b66f68353ec62113742e5b045f92da733866a7952673df4b1c45a
dc4f19e5e4dc8fcc3c4ef23408bb2786351dbc4c6d68fd8f882bcbdf52211ff3
fb6eae45c38c680a2580247feed29592f40ab479339244c58b7f3397e773fbcd
+ 15 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230703-jw4wfsfe64/
Unpacked files
SH256 hash:
1e963d3a906baa2ffe4291bf0497abbe8ec2ba0c06df68e2d0575c21eab35ae5
MD5 hash:
14c87823f007e7f22a14caf9749d506b
SHA1 hash:
8201e266b3e5ca62ab9af0d886ba6c1e00dfd9b2
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
1d5eac4440755b424eca75b8e68abe4eb525eb212eefab30cbc153dd12a281d2
MD5 hash:
865bb84a0ec166dcb296e6dab1873c7e
SHA1 hash:
3f7097d138a4712a6adc12e02e350e2691b685f0
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
43729907cfa8c89f654114c498dbb7b8922a46d687306eadda2285edef3a115f
MD5 hash:
8ddc67952a314d63383e868b3af05f0e
SHA1 hash:
e2718460721c3c4b98ebaa6284c153b2b92eccdd
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
bfb88c3e29dbe6aa52db640d5e8e176bf8bf6ab94a5d49481134686838ec571e
MD5 hash:
811fd6c22a16bb47abd80f8ecf45ed11
SHA1 hash:
50eb1ea97e74edf4385847255433769327baaf9e
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
1e963d3a906baa2ffe4291bf0497abbe8ec2ba0c06df68e2d0575c21eab35ae5
MD5 hash:
14c87823f007e7f22a14caf9749d506b
SHA1 hash:
8201e266b3e5ca62ab9af0d886ba6c1e00dfd9b2
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
1d5eac4440755b424eca75b8e68abe4eb525eb212eefab30cbc153dd12a281d2
MD5 hash:
865bb84a0ec166dcb296e6dab1873c7e
SHA1 hash:
3f7097d138a4712a6adc12e02e350e2691b685f0
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
43729907cfa8c89f654114c498dbb7b8922a46d687306eadda2285edef3a115f
MD5 hash:
8ddc67952a314d63383e868b3af05f0e
SHA1 hash:
e2718460721c3c4b98ebaa6284c153b2b92eccdd
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
bfb88c3e29dbe6aa52db640d5e8e176bf8bf6ab94a5d49481134686838ec571e
MD5 hash:
811fd6c22a16bb47abd80f8ecf45ed11
SHA1 hash:
50eb1ea97e74edf4385847255433769327baaf9e
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
1e963d3a906baa2ffe4291bf0497abbe8ec2ba0c06df68e2d0575c21eab35ae5
MD5 hash:
14c87823f007e7f22a14caf9749d506b
SHA1 hash:
8201e266b3e5ca62ab9af0d886ba6c1e00dfd9b2
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
1d5eac4440755b424eca75b8e68abe4eb525eb212eefab30cbc153dd12a281d2
MD5 hash:
865bb84a0ec166dcb296e6dab1873c7e
SHA1 hash:
3f7097d138a4712a6adc12e02e350e2691b685f0
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
43729907cfa8c89f654114c498dbb7b8922a46d687306eadda2285edef3a115f
MD5 hash:
8ddc67952a314d63383e868b3af05f0e
SHA1 hash:
e2718460721c3c4b98ebaa6284c153b2b92eccdd
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
bfb88c3e29dbe6aa52db640d5e8e176bf8bf6ab94a5d49481134686838ec571e
MD5 hash:
811fd6c22a16bb47abd80f8ecf45ed11
SHA1 hash:
50eb1ea97e74edf4385847255433769327baaf9e
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
1e963d3a906baa2ffe4291bf0497abbe8ec2ba0c06df68e2d0575c21eab35ae5
MD5 hash:
14c87823f007e7f22a14caf9749d506b
SHA1 hash:
8201e266b3e5ca62ab9af0d886ba6c1e00dfd9b2
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
1d5eac4440755b424eca75b8e68abe4eb525eb212eefab30cbc153dd12a281d2
MD5 hash:
865bb84a0ec166dcb296e6dab1873c7e
SHA1 hash:
3f7097d138a4712a6adc12e02e350e2691b685f0
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
43729907cfa8c89f654114c498dbb7b8922a46d687306eadda2285edef3a115f
MD5 hash:
8ddc67952a314d63383e868b3af05f0e
SHA1 hash:
e2718460721c3c4b98ebaa6284c153b2b92eccdd
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
bfb88c3e29dbe6aa52db640d5e8e176bf8bf6ab94a5d49481134686838ec571e
MD5 hash:
811fd6c22a16bb47abd80f8ecf45ed11
SHA1 hash:
50eb1ea97e74edf4385847255433769327baaf9e
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
SH256 hash:
24612d672e37bb6e47a89202b9a442b94eb7a353aa899746621c0c15389ab4f5
MD5 hash:
a10bc885cfabcc3a1b7094380822e6e5
SHA1 hash:
b71e7cfd0b60a0e1e86bd580fbd85085937523eb
Link:
https://www.unpac.me/results/a745c080-b291-4ac1-8c8f-372c11a667e4/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:QbotStuff
Create hunting rule
Author:anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/405742/

Comments