MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2861a4f8e40b9023bd9fc09eef5c2b83f55616d4ce5b82143518f96c9e684d68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2861a4f8e40b9023bd9fc09eef5c2b83f55616d4ce5b82143518f96c9e684d68
SHA3-384 hash:	df5aa87b9a7ac3ae636ba43e7da603cfd76dbc00a38253975f4889a5a9e77499c043d19cc2a31b06f2ef76a9c1e88742
SHA1 hash:	6f83dcb60d2beb0c065d04c788c8fb9761591832
MD5 hash:	b63f38f2f3c85029224afa21136b6fca
humanhash:	floor-island-illinois-johnny
File name:	b63f38f2f3c85029224afa21136b6fca.exe
Download:	download sample
File size:	1'806'650 bytes
First seen:	2023-07-19 06:24:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0ae9e38912ff6bd742a1b9e5c003576a (10 x DCRat, 7 x RedLineStealer, 4 x AsyncRAT)
ssdeep	49152:HdgOt/9uSR4t9q5uA15I3snxa+ZE3ZOz9nQ:HF/QyC9qwA15gsxRZEJOy
Threatray	596 similar samples on MalwareBazaar
TLSH	T129852352FAC45AB1D97225311A39AB25AB3D7C705F22CDCF9340592ECD321C0AA3A776
TrID	89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.5% (.EXE) Win64 Executable (generic) (10523/12/4) 2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	abuse_ch
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

259

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

b63f38f2f3c85029224afa21136b6fca.exe

Verdict:

Suspicious activity

Analysis date:

2023-07-19 06:24:56 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e7366c60-3e6c-478a-949c-0d55d19770bc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/424478/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Ciusky.Gen.6.14225.3066.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm greyware lolbin overlay packed packed replace setupapi shdocvw shell32

Link:

https://www.filescan.io/uploads/64b781bf8ca71f19e089383e/reports/572a9e60-a3fe-471e-8231-7b8c44adf638/overview

Hybrid Analysis Trojan.Ciusky.Generic

Verdict:

Malicious

Labled as:

Trojan.Ciusky.Generic

Link:

https://www.hybrid-analysis.com/sample/2861a4f8e40b9023bd9fc09eef5c2b83f55616d4ce5b82143518f96c9e684d68

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a8a2b3fa-cf24-4554-9417-c1d8790e9be4

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1275739

Signature

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2861a4f8e40b9023bd9fc09eef5c2b83f55616d4ce5b82143518f96c9e684d68/

ReversingLabs TitaniumCloud Win32.Trojan.Fauppod

Threat name:

Win32.Trojan.Fauppod

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-19 06:25:05 UTC

File Type:

PE (Exe)

Extracted files:

18

AV detection:

14 of 25 (56.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fbq2j6heboichpm7ycpo6xblqp2vmfwuzznyefbvdd4wzhtijvua._file

Threatray malicious

Verdict:

malicious

Similar samples:

33e686777d4e60947c1bc7d7743f006901dd209ae7fa9c6bd3d758dfc9b0aafc

3c37d2667425e332cd0e553904d6f759fc6e1c8e8caa7dc7c1f3906fe4a5b846

449da77fc37b5147386d7ade3fd7f522272c0f3208e0683f2b7b881a94a8c60f

5acac023c7d890d3074e9a783157d765223bbe7e4a5c12ab495d4711e0b9e440

7eb0ebc81444d77b62e03f1757763740d77009bd53a01ef19ce66e4dfe9bff77

92b4f87f9ef64d1b37a657742438e136f72434dde1b8d30865e419534fdd8260

a040c35ef32cbe289d5bc2b8014adcb961ab3aed1e2873d1f2e335933e97927b

bfbe18d15b02ca49b998ced257354495d126513f86e26b8ad6dbe1db9cd568bf

c5999e49c8ee21282c720c466cb71cff26ced8c5c03193c33b993d7deacd6bb3

+ 586 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230719-g6mc2sha5y/

Behaviour

Modifies registry class

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

89d897036114d94c0767fd428c7f9194e170c7910f22e0fef55672e5453b2f28

MD5 hash:

431b57a11508ac6ff231402039464167

SHA1 hash:

58b9932ef7aa6bdd74895cf0f87f8fb204eab900

Link:

https://www.unpac.me/results/e837a52e-efac-4355-8ae6-2b3a13afdf40/

SH256 hash:

2861a4f8e40b9023bd9fc09eef5c2b83f55616d4ce5b82143518f96c9e684d68

MD5 hash:

b63f38f2f3c85029224afa21136b6fca

SHA1 hash:

6f83dcb60d2beb0c065d04c788c8fb9761591832

Link:

https://www.unpac.me/results/e837a52e-efac-4355-8ae6-2b3a13afdf40/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 2861a4f8e40b9023bd9fc09eef5c2b83f55616d4ce5b82143518f96c9e684d68

(this sample)

Cape

https://www.capesandbox.com/analysis/424478/

  

URLhaus

https://urlhaus.abuse.ch/url/2685099/

  

Delivery method

Distributed via web download