🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28adccba2210fd4a93ab9e9b7ec9843757f92470e42ffc8bbdef2267226e01b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


InstallRex


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28adccba2210fd4a93ab9e9b7ec9843757f92470e42ffc8bbdef2267226e01b1
SHA3-384 hash: 9df4682a6ef1c0308875bf5631c6ec440b9d02e01b5dc850f6aa1f6a56f53fd6d4caf3c5b03ded9d1b16d2e6cec56883
SHA1 hash: c0bb29d02b129fdfb636d5ca5bfad5bcdba3f46d
MD5 hash: 2e8c571d020ea1e5f13e06c9667939c3
humanhash: lamp-echo-fish-venus
File name:Trojan.Win32.AntiFW.b-28adccba2210fd4a93ab9e9b7ec9843757f92470e42ffc8bbdef2267226e01b1
Download: download sample
Signature InstallRex
Create hunting rule
File size:323'800 bytes
First seen:2022-08-31 03:08:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a8286b574ff850cd002ea6282d15aa40 (8 x Adware.InstalleRex, 2 x InstallRex)
ssdeep 6144:VrybUzkuvcBYC47l2xphuK2+Otbaysqo+/VKitoTxwbs5iD3B2phow:VrLkuveY3EMK9ObxD/06s5w3BLw
TLSH T1966423C79ACB7672E2911438598289CAD771B50360E62C6FFBDC4FEB10E0A473967391
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
dhash icon 92e0a496a2cada72 (2 x Adware.InstalleRex, 1 x InstallRex)
Reporter OSimao
Tags:Adware exe InstallRex signed

Code Signing Certificate

Organisation:Sergey Petrov
Issuer:COMODO Code Signing CA 2
Algorithm:sha1WithRSAEncryption
Valid from:2013-08-21T00:00:00Z
Valid to:2014-08-21T23:59:59Z
Serial number: 0ad084e865d27cd546d21db6edf89d48
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 256ee69214f4ba6a07c56ef6a6470a721ae8dca0e0397ca8322cab3e8f575eb6
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
428
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/306533/
Detection(s):
SecuriteInfo.com.Adware.Certificate-918.UNOFFICIAL
Create hunting rule

Win.Trojan.Antifw-173
Create hunting rule

Win.Adware.Agent-1388696
Create hunting rule

Win.Adware.Agent-1388697
Create hunting rule

Win.Trojan.Installerex-249
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Сreating synchronization primitives
Creating a window
Creating a file
Searching for the window
Delayed writing of the file
DNS request
Sending an HTTP POST request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed pup
Link:
https://www.filescan.io/uploads/630ed154fbf1afa4927acbc9/reports/bad47595-ed5b-4323-93ea-a325889a5912/overview
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1061139
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28adccba2210fd4a93ab9e9b7ec9843757f92470e42ffc8bbdef2267226e01b1/
Threat name:
Win32.PUA.InstallRex
Create hunting rule
Status:
Malicious
First seen:
2014-04-24 01:52:00 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
28 of 29 (96.55%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fcw4zorccd6uve5lt2nx5smeg5l7sjdq4qx7zc5554rgoitoagyq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/220831-dnfk1agadm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Checks installed software on the system
Maps connected drives based on registry
Loads dropped DLL
Unpacked files
SH256 hash:
14ed2a8c11369abb64d2984d959c2e740ba1fd818f636edd8f60fa39272accb8
MD5 hash:
2549da03bd024fd7117e87f0edeec347
SHA1 hash:
8ff37eb8baf73b1854d3634dd968c482016a85bb
Link:
https://www.unpac.me/results/0e107414-1019-43bf-841a-063d07f5050d/
SH256 hash:
ae81c483a4d96eebf55cabc6a0f559036085198c718bbb22e3a668a74b9011f4
MD5 hash:
565c73345f6362263e75e3f46e4cd4ed
SHA1 hash:
ff613793f01ba0cfdc160a59d12d87868e4b9ee4
Link:
https://www.unpac.me/results/0e107414-1019-43bf-841a-063d07f5050d/
SH256 hash:
4ef3808d4df664f1750ecf0b1e84cd290d0d044a42f48862d78f551299bd9b2b
MD5 hash:
abe24aac92b7d012979fb3446518628f
SHA1 hash:
91157b7e5eaa120eed03724e729cc1f7f2cc5f0c
Link:
https://www.unpac.me/results/0e107414-1019-43bf-841a-063d07f5050d/
SH256 hash:
28adccba2210fd4a93ab9e9b7ec9843757f92470e42ffc8bbdef2267226e01b1
MD5 hash:
2e8c571d020ea1e5f13e06c9667939c3
SHA1 hash:
c0bb29d02b129fdfb636d5ca5bfad5bcdba3f46d
Link:
https://www.unpac.me/results/0e107414-1019-43bf-841a-063d07f5050d/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:PUP_InstallRex_AntiFWb
Create hunting rule
Author:Florian Roth
Description:Malware InstallRex / AntiFW

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/306533/

Comments