MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2cc5eb71267dc9635107b324b5213b3e86082b369712355426046eeffcf2ee15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2cc5eb71267dc9635107b324b5213b3e86082b369712355426046eeffcf2ee15
SHA3-384 hash: 273f9f33858793e202d0d47778ff75212b264f5d8fe7b1167f79bfa79034745272660ac5a242194aacd670551d207fe2
SHA1 hash: 7c18de878b86c278e6c1494ecd9ee0ff22769c4f
MD5 hash: f74f38976fb53d18f9ac2d912620c52f
humanhash: mango-friend-lemon-green
File name:f74f38976fb53d18f9ac2d912620c52f
Download: download sample
File size:1'020'416 bytes
First seen:2023-03-05 05:27:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:/6lKz5DBr+0BDyhL2NiIzpwJClO3WOdMt56NRvy:/c6TN9eJrGOdfNVy
Threatray 262 similar samples on MalwareBazaar
TLSH T188252387AA86C562C1656732FDF73F510B7286F58893521B04AEECE1669FB863D0C4CC
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter zbetcheckin
Tags:32 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
235
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
b2e72d64e1ebf48a7add761177ac71f6.exe
Verdict:
Malicious activity
Analysis date:
2023-03-02 08:22:51 UTC
Tags:
loader smoke trojan
Link:
https://app.any.run/tasks/29283f70-800d-44c5-8a9c-4106f696f542

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/371681/
Detection(s):
Win.Trojan.EmbeddedDotNetBinary-9940868-0
Create hunting rule

Win.Trojan.EmbeddedReversedDLL-9940922-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bladabindi obfuscated packed
Link:
https://www.filescan.io/uploads/6404286566e79c93ba0de1ec/reports/9bed38d2-aee6-4dea-a8da-b69e3ae10010/overview
Verdict:
Malicious
Labled as:
MSIL.Bladabindi.Generic
Link:
https://www.hybrid-analysis.com/sample/2cc5eb71267dc9635107b324b5213b3e86082b369712355426046eeffcf2ee15
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/3b097241-af81-4b73-ac93-a43e7656332f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1187283
Signature
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 820155 Sample: Trw0mAsErm.exe Startdate: 05/03/2023 Architecture: WINDOWS Score: 84 54 Multi AV Scanner detection for submitted file 2->54 56 Machine Learning detection for sample 2->56 58 Yara detected Costura Assembly Loader 2->58 7 Trw0mAsErm.exe 1 7 2->7         started        11 Ybrnaqnlju.exe 4 2->11         started        13 Ybrnaqnlju.exe 3 2->13         started        15 iqret.exe 3 2->15         started        process3 file4 44 C:\Users\user\AppData\...\Ybrnaqnlju.exe, PE32 7->44 dropped 46 C:\Users\...\Ybrnaqnlju.exe:Zone.Identifier, ASCII 7->46 dropped 48 C:\Users\user\AppData\...\Trw0mAsErm.exe.log, ASCII 7->48 dropped 60 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 7->60 62 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->62 64 Encrypted powershell cmdline option found 7->64 17 Trw0mAsErm.exe 5 7->17         started        20 powershell.exe 16 7->20         started        66 Multi AV Scanner detection for dropped file 11->66 68 Machine Learning detection for dropped file 11->68 70 Injects a PE file into a foreign processes 11->70 22 powershell.exe 11->22         started        24 Ybrnaqnlju.exe 11->24         started        26 powershell.exe 13->26         started        28 Ybrnaqnlju.exe 13->28         started        signatures5 process6 file7 40 C:\Users\user\AppData\Local\...\iqret.exe, PE32 17->40 dropped 42 C:\Users\user\...\iqret.exe:Zone.Identifier, ASCII 17->42 dropped 30 WerFault.exe 17->30         started        34 conhost.exe 20->34         started        36 conhost.exe 22->36         started        38 conhost.exe 26->38         started        process8 dnsIp9 52 192.168.2.1 unknown unknown 30->52 50 C:\ProgramData\Microsoft\...\Report.wer, Unicode 30->50 dropped file10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2cc5eb71267dc9635107b324b5213b3e86082b369712355426046eeffcf2ee15/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2023-03-02 03:14:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ftc6w4jgpxewguihwmslkij3h2daqkzws4jdkvbgarxo77hs5ykq._file
Verdict:
malicious
Similar samples:
46b6798990aefaedd162220d0593c6b22aa72fa3afc71ad4b12d6781793a9e06
5d45948167c781bc6167406bf9b8f97f4fea8d976581c6c5130d9ee5a2b11831
5e6776ba02afa4c03138edcdf1e10dabee3efd6afd1620dcdb3138e7632bcb79
65bea8ecbc22a05fe6cdd7108d9859e22de0a6796c7597ff299e4baf0dde04ad
668eb4590a79e6a228f5048fe1736e40dce34034398cf762e6c6ba42599cb8e7
c180f58783642d9688ad20f32ce72e504accf1d101f1591b39b0d4e0f429fe3f
c7554a7609cf9428545460211a203ed575173798679198a502fe847bff3cc044
ca4033db02bded2739ca4e31c72910e4c5995f9437cda0c4767a8113166d84b6
ffe2e43e59074cf27875cc31e8be84503b1a6854dd3f2480b5aff7b6b220a416
+ 252 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/230305-f51nlsfg77/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Unpacked files
SH256 hash:
6b77e2bfff019609c509c3e559c6870dbb7e8d8b9979affb98440e079c99e354
MD5 hash:
958e4d62824c29a594256646c3d6bbf9
SHA1 hash:
e2f2004a3932381c8e70ecde39a129f0f6add9b0
Link:
https://www.unpac.me/results/01935c87-0984-4b10-83be-4f1aaecf4f95/
SH256 hash:
0b6a191f359152eea6fd35a2bc3850e8b2a60a26e944925b20cdc20693e69ab9
MD5 hash:
cb05ce59804430d6dd75dc2ef1c9d31b
SHA1 hash:
c520098c0d33bf5d39c8f122b106c7b0ce46bed5
Link:
https://www.unpac.me/results/01935c87-0984-4b10-83be-4f1aaecf4f95/
SH256 hash:
e58aef4a29aa720ef812c41d3b1c59e07bad8e5a099c92908a52e80d2d40c4ff
MD5 hash:
237fb28b7ae8c88d01b1f2cb043e7cb9
SHA1 hash:
96a4025189e914df3042b50cc30bbdc3bb04f1c0
Link:
https://www.unpac.me/results/01935c87-0984-4b10-83be-4f1aaecf4f95/
SH256 hash:
d552f447b85d77d5c8526db28445e686ab9f383b698a5e6c4b8b5674a544cec4
MD5 hash:
8595bc1367e66436f90e1aa3a0f390c6
SHA1 hash:
72dedb3fcce1d941968b192aa4542a506f5c25d7
Link:
https://www.unpac.me/results/01935c87-0984-4b10-83be-4f1aaecf4f95/
SH256 hash:
efa1c5a6f8c251b953889789669d6724a5961a0b5677dabd21acc2c1e0def4f3
MD5 hash:
40a7925715a0081bb4a73131cc7d84d3
SHA1 hash:
dad22e0e82864f77ea9c131f40b6a789a9a03829
Link:
https://www.unpac.me/results/01935c87-0984-4b10-83be-4f1aaecf4f95/
SH256 hash:
50913022a906934cfc1005fae8a59722491d56e34de8c0c9b1f25b51c1ff0178
MD5 hash:
63812bdaa26594d74ae272dfed425ac6
SHA1 hash:
6af6366a903ba16d98b905580f31a87fd3d51f23
Link:
https://www.unpac.me/results/01935c87-0984-4b10-83be-4f1aaecf4f95/
SH256 hash:
99ab1ab754ec1b48a4408afd1ea2ba62445944cd69c194dd0b0831429f6ac9d3
MD5 hash:
aa9abaaaef8edce4c73dc8276a4128ef
SHA1 hash:
07830eda93b91ed2dc28c6da4c0842407db85381
Link:
https://www.unpac.me/results/01935c87-0984-4b10-83be-4f1aaecf4f95/
SH256 hash:
2cc5eb71267dc9635107b324b5213b3e86082b369712355426046eeffcf2ee15
MD5 hash:
f74f38976fb53d18f9ac2d912620c52f
SHA1 hash:
7c18de878b86c278e6c1494ecd9ee0ff22769c4f
Link:
https://www.unpac.me/results/01935c87-0984-4b10-83be-4f1aaecf4f95/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/2cc5eb71267dc9635107b324b5213b3e86082b369712355426046eeffcf2ee15

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Typical_Malware_String_Transforms
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:Typical_Malware_String_Transforms_RID3473
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 2cc5eb71267dc9635107b324b5213b3e86082b369712355426046eeffcf2ee15

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2558739/
Cape
Cape
https://www.capesandbox.com/analysis/371681/

Comments


Avatar
zbet commented on 2023-03-05 05:28:04 UTC

url : hxxps://aamroaviation.com/blue32_c.exe