MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2964fb55787de6bcba3eeb420da1036853baf6b528b75e751476d790b8fcadf6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2964fb55787de6bcba3eeb420da1036853baf6b528b75e751476d790b8fcadf6
SHA3-384 hash: cdfb11ea415eca6712bfa88f064c789d9034145f71daa6a6a2a13f47af1bb76f989141a5a24b79a112c2913bae05a018
SHA1 hash: 3a89a7dfe6bb3fe8dc54338e353ab3786c1a806c
MD5 hash: 77f11e6ba81797d9bb87d6e1da73b57a
humanhash: romeo-vegan-california-edward
File name:_ksjuzwpsdkyivvzuzylyicymperoxkvtkleiswub.msi
Download: download sample
File size:1'984'000 bytes
First seen:2021-09-30 15:04:00 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:F02YAn38RpA7puDgDfqRFbVpexcwshI3OD1uqjYBDQzt/sTSqRsKZTPQrY+EA:fYAnsR+l8gDlQrYJA
Threatray 148 similar samples on MalwareBazaar
TLSH T155957E33F2D18437D0731A7C9D6BA768AA25BE101E38984F3BE41F4C5F396817A25297
Reporter abuse_ch
Tags:msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
151
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/193688/
Detection(s):
Win.Downloader.Zusy-9884239-0
Create hunting rule

SecuriteInfo.com.RDMK.cmRtazpKxKzi0pVLtXUmAmezzdjf.17904.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/2964fb55787de6bcba3eeb420da1036853baf6b528b75e751476d790b8fcadf6
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/862090
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 494513 Sample: _ksjuzwpsdkyivvzuzylyicympe... Startdate: 30/09/2021 Architecture: WINDOWS Score: 48 9 Multi AV Scanner detection for submitted file 2->9 5 msiexec.exe 2 2->5         started        7 msiexec.exe 2->7         started        process3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2964fb55787de6bcba3eeb420da1036853baf6b528b75e751476d790b8fcadf6/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2021-09-30 15:04:12 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ffspwvlypxtlzor65nba3iidnbj3v5vvfc3v45iuo3lzboh4vx3a._file
Verdict:
malicious
Similar samples:
2f5958ef72eab8ecb7d91cba766ea7324502fc70797f7668afa9dcc9fa7ab431
38c4baea01347f88b497f928343cb19d1e68a693369da7cecdde067281e26fa9
38fb7f29369f2970ac2c97548de9d64eff1b5f4dfa183a7ac4730ddaa6b1586c
3f145e6eb89b9f7f01080d21b89ea423b288eaa00c8d760e5cb40b6ef5e0b366
770f3ed90de0e812f9e878bd4f3d6ed7785286cda6e1aaf0b7a17e30e8cb778f
9f0d3b49b6eea3eff22dce2838b10e8e3b03c45f31212f8d26ae31cd576f1104
c46837174f6b770db91fb663d9670376cdfd54894daa19694537d1d6100013b1
c55d93f8c25e4ed3886cc125f129ded48bf781990a143cbe5996f38fd2ab7fc7
cb4f55308ba1f8617c00505983b42da10d704960a1dbef03075f370015f6f21b
f22ee649e4377d819c87af15623076bc6a28aac49e6d99cf10c9a81d9df766b4
+ 138 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/210930-sfljlsabak/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Enumerates connected drives
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.25
Link:
https://yomi.yoroi.company/submissions/2964fb55787de6bcba3eeb420da1036853baf6b528b75e751476d790b8fcadf6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/193688/

Comments