MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fc5d385b3ec6a3d5fe5c90bbc26105d8f9387597bb1705bf042451b25da4fbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 4 File information Comments 1

SHA256 hash:	2fc5d385b3ec6a3d5fe5c90bbc26105d8f9387597bb1705bf042451b25da4fbb
SHA3-384 hash:	49ec645b177970cad81d7bae58c7acf0a889d8fb6df04edf1d472f31b7dc9de360f4ed6732945f573a80c9edc0b9d57f
SHA1 hash:	12239e16e005f3a1c213cdb23e14b91e0737bad4
MD5 hash:	ce81eed854cece7bf84332694f26943f
humanhash:	purple-pip-cat-uniform
File name:	ce81eed854cece7bf84332694f26943f
Download:	download sample
File size:	732'312 bytes
First seen:	2021-11-07 14:22:09 UTC
Last seen:	2021-11-07 17:18:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'125 x AgentTesla, 20'138 x Formbook, 12'362 x SnakeKeylogger)
ssdeep	12288:q1f8uiEWyovxISvjAAr9w1000100001ZqOV8Ww/uQRqekzTIHNafnAr9w100010S:qx8uiEWdeSvBX8JqekzTUNa8/F
TLSH	T1DAF48D21A9C98CA9D424C77644F7472243B4BC076DA6DBCE62E872924F723C948179FF
File icon (PE):
dhash icon	9cb2b6b6b49aa280
Reporter	zbetcheckin
Tags:	32 exe

Intelligence

File Origin

# of uploads :

# of downloads :

107

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/203036/

Detection(s):

SecuriteInfo.com.Variant.Bulz.809522.19156.19068.UNOFFICIAL

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

evasive obfuscated overlay packed packed

Link:

https://www.filescan.io/uploads/6187e148d8143ea269cddad0/reports/2d4945d8-1f92-4916-b11f-a3e1f2c3e79f/overview

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9f16078d-c580-4ff6-9a57-a826b1ed83ce

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/884792

Signature

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2fc5d385b3ec6a3d5fe5c90bbc26105d8f9387597bb1705bf042451b25da4fbb/

Threat name:

ByteCode-MSIL.Trojan.Bulz

Status:

Malicious

First seen:

2019-10-19 02:08:20 UTC

AV detection:

6 of 45 (13.33%)

Threat level:

5/5

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/211107-rp47msada6/

Behaviour

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Loads dropped DLL

Downloads MZ/PE file

Executes dropped EXE

Unpacked files

SH256 hash:

2fc5d385b3ec6a3d5fe5c90bbc26105d8f9387597bb1705bf042451b25da4fbb

MD5 hash:

ce81eed854cece7bf84332694f26943f

SHA1 hash:

12239e16e005f3a1c213cdb23e14b91e0737bad4

Link:

https://www.unpac.me/results/567f4507-c09f-413e-ba73-a7e72379e75f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/2fc5d385b3ec6a3d5fe5c90bbc26105d8f9387597bb1705bf042451b25da4fbb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 2fc5d385b3ec6a3d5fe5c90bbc26105d8f9387597bb1705bf042451b25da4fbb

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1761107/

Cape

https://www.capesandbox.com/analysis/203036/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-11-07 14:22:10 UTC

url : hxxp://server.toeicswt.co.kr/svr_netchecker/server.asp?V_COMMAND=3002&V_PROGNAME=SJPTManagerLauncher.exe