MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d3c9078e40a6dd286b36dbaaf1f0a367d22a0f9e30a2fc93d1d8ba5b9b97ce8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2d3c9078e40a6dd286b36dbaaf1f0a367d22a0f9e30a2fc93d1d8ba5b9b97ce8
SHA3-384 hash:	4270fca64bf1cbdbb4891fc58fa71fa4f804302a2cd1f4463c92138102f6ff93ac6deaace638a4108541181bbdb10897
SHA1 hash:	589b7e856075c56dd5f177c76776059de4b9874d
MD5 hash:	ff7fa522ad7a8ca013b2ec29ed3e702b
humanhash:	oscar-jupiter-arkansas-nevada
File name:	file
Download:	download sample
File size:	576'512 bytes
First seen:	2023-07-23 11:35:01 UTC
Last seen:	2023-07-23 23:22:18 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	12288:fU2J+6LLbapau7nKoAm4TWu0AY81m7PH+:fZTapau7zA3TRYsg/+
TLSH	T144C412921395BD84ECD1013350E8040DD77A6C3E607DBABF6964FA904E6B8FADF02D66
TrID	56.5% (.EXE) Win64 Executable (generic) (10523/12/4) 11.0% (.ICL) Windows Icons Library (generic) (2059/9) 10.9% (.EXE) OS/2 Executable (generic) (2029/13) 10.7% (.EXE) Generic Win/DOS Executable (2002/3) 10.7% (.EXE) DOS Executable Generic (2000/1)
Reporter	andretavare5
Tags:	85-217-144-143 exe

andretavare5

Sample downloaded from http://85.217.144.143/files/Ads.exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

348

Origin country :

US

Vendor Threat Intelligence

ANY.RUN smoke

Malware family:

smoke

Alert

Create hunting rule

ID:

1

File name:

file

Verdict:

Malicious activity

Analysis date:

2023-07-23 11:35:32 UTC

Tags:

lgoogloader gcleaner loader smoke trojan stealer vidar arkei redline

Link:

https://app.any.run/tasks/f1515df4-4cc0-4005-8be9-64bd4fcaad01

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/429529/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win64.TrojanX-gen.30768.14248.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file

Creating a service

Launching a service

Loading a system driver

Creating a file in the Windows subdirectories

Launching a process

Creating a file in the Windows directory

Enabling autorun for a service

Forced shutdown of a system process

Unauthorized injection to a system process

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/64bd1067e179a8163b7de0f1/reports/a87fc101-1205-4135-8659-e51240214267/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/2d3c9078e40a6dd286b36dbaaf1f0a367d22a0f9e30a2fc93d1d8ba5b9b97ce8

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ae0d2ab9-8bc2-4b76-a42c-4386c82c7ac6

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1277879

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sample is not signed and drops a device driver

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected Costura Assembly Loader

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2d3c9078e40a6dd286b36dbaaf1f0a367d22a0f9e30a2fc93d1d8ba5b9b97ce8/

ReversingLabs TitaniumCloud Win64.Trojan.Privateloader

Threat name:

Win64.Trojan.Privateloader

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-07-23 04:38:12 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

2

AV detection:

15 of 38 (39.47%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fu6ja6hebjw5fbvtnw5k6hykgz6sfihz4mfc7sj5dwf2lonzptua._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/230723-np2jzaee61/

Behaviour

Suspicious behavior: LoadsDriver

UnpacMe

Unpacked files

SH256 hash:

2d3c9078e40a6dd286b36dbaaf1f0a367d22a0f9e30a2fc93d1d8ba5b9b97ce8

MD5 hash:

ff7fa522ad7a8ca013b2ec29ed3e702b

SHA1 hash:

589b7e856075c56dd5f177c76776059de4b9874d

Link:

https://www.unpac.me/results/9c000242-33e8-4630-a641-d5a57f14cc2e/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/2d3c9078e40a6dd286b36dbaaf1f0a367d22a0f9e30a2fc93d1d8ba5b9b97ce8

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

Dropped by

PrivateLoader

  

Delivery method

Distributed via drive-by

  

URLhaus

https://urlhaus.abuse.ch/url/2681759/

Cape

https://www.capesandbox.com/analysis/429529/