MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28332d3e7e3ec9047ce5a3d3304764345680189e9def1eb54565d7c952bc9bc3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	28332d3e7e3ec9047ce5a3d3304764345680189e9def1eb54565d7c952bc9bc3
SHA3-384 hash:	c1cf01a28c54fb10af17e8968c18b40b4841d9021ecc7ecd6783e3651bfc6b8c38ce0b31655f478b6c6e94442affb7dc
SHA1 hash:	745a3a72cd9270f4a003a199a9dc6ba195c82ed2
MD5 hash:	f4621d94bb373e1d265cb2745bb5d6dc
humanhash:	maryland-solar-michigan-mexico
File name:	f4621d94bb373e1d265cb2745bb5d6dc.exe
Download:	download sample
File size:	881'152 bytes
First seen:	2023-06-13 10:21:06 UTC
Last seen:	2023-06-13 10:45:08 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	12288:Pq8R0uZKC69WsuWfKDTEnH1FEC3Q3mBnJPy8:cA32y8
Threatray	1 similar samples on MalwareBazaar
TLSH	T1F415C3807054E520E5AC32F65D39D4D0136ABF6A2C00D356B8F9BBEE6C71617CE8726E
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	abuse_ch
Tags:	exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

266

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

f4621d94bb373e1d265cb2745bb5d6dc.exe

Verdict:

Malicious activity

Analysis date:

2023-06-13 10:30:54 UTC

Tags:

opendir

Link:

https://app.any.run/tasks/da8695e0-8e6e-40ea-a7df-f979fd92581f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/398226/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win64.WormX-gen.26923.6183.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a file

Creating a service

Launching a service

Loading a system driver

Creating a file in the Windows subdirectories

Launching a process

Creating a file in the Windows directory

Enabling autorun for a service

Forced shutdown of a system process

Sending an HTTP GET request to an infection source

Unauthorized injection to a system process

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6488434b28381b85ed1a28e3/reports/c2b3d558-fad7-4afc-9ba2-ad471792dfc9/overview

Hybrid Analysis MSIL/Kryptik_AGeneric.AWK trojan

Verdict:

Malicious

Labled as:

MSIL/Kryptik_AGeneric.AWK trojan

Link:

https://www.hybrid-analysis.com/sample/28332d3e7e3ec9047ce5a3d3304764345680189e9def1eb54565d7c952bc9bc3

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/eb2e8912-c351-4b23-8688-3e617b054f32

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1253522

Signature

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample is not signed and drops a device driver

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/28332d3e7e3ec9047ce5a3d3304764345680189e9def1eb54565d7c952bc9bc3/

ReversingLabs TitaniumCloud ByteCode-MSIL.Adware.RedCap

Threat name:

ByteCode-MSIL.Adware.RedCap

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-13 05:55:56 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

14

AV detection:

18 of 37 (48.65%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fazs2pt6h3eqi7hfupjtar3egrliage6txxr5nkfmxl4suv4tpbq._file

Threatray malicious

Verdict:

malicious

Similar samples:

4d9e0a28423515a1574837873cc75c3c495daebf2247e5353f9028d97ccf3fb6

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/230613-md8ngafg54/

Behaviour

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

UnpacMe

Unpacked files

SH256 hash:

28332d3e7e3ec9047ce5a3d3304764345680189e9def1eb54565d7c952bc9bc3

MD5 hash:

f4621d94bb373e1d265cb2745bb5d6dc

SHA1 hash:

745a3a72cd9270f4a003a199a9dc6ba195c82ed2

Link:

https://www.unpac.me/results/82914381-cd79-4cc0-9fbc-e3de6e1132b7/

VMRay SmokeLoader

Malware family:

SmokeLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/28332d3e7e3e/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/28332d3e7e3ec9047ce5a3d3304764345680189e9def1eb54565d7c952bc9bc3

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 28332d3e7e3ec9047ce5a3d3304764345680189e9def1eb54565d7c952bc9bc3

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2627632/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/398226/