MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30f1233c3ff4700a11e179f579008b3c9e57d193dede2df2e6b6ee7addd04743. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30f1233c3ff4700a11e179f579008b3c9e57d193dede2df2e6b6ee7addd04743
SHA3-384 hash: 675da378d87ba3e2dd72cf156ba18ed5fefd0b20965621524468b8ed60cc2d7910e27c3d46037571d3635d71235c291f
SHA1 hash: ead9a4e386da6baa118656a58bec25dbd6c4b1cc
MD5 hash: c3d347e71f7f7e37033e6d44609aeef0
humanhash: kansas-potato-glucose-sodium
File name:virussign.com_c3d347e71f7f7e37033e6d44609aeef0
Download: download sample
File size:65'536 bytes
First seen:2022-07-13 14:26:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 87bed5a7cba00c7e1f4015f1bdae2183 (3'034 x Jadtre, 23 x IcedID, 23 x Blackmoon)
ssdeep 1536:2tXuRksrz8GvnGd52Mp0BPx957eG0S2gh:2JuRR8a6EMpyPx9leG0S
TLSH T1B153C00F3AD96526E9C34A706A72A725593FB6B07E91C74F56F4420E0DF0BC06D1A21E
dhash icon a4a1b4ecd335ff5b (25 x NanoCore, 4 x AgentTesla, 3 x Zegost)
Reporter KdssSupport
Tags:exe


Avatar
KdssSupport
Uploaded with API

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/287284/
Detection(s):
Win.Trojan.Philis-28
Create hunting rule

PUA.Win.Packer.UPack-2
Create hunting rule

Win.Worm.Mytob-399
Create hunting rule

PUA.Win.Packer.Upack-47
Create hunting rule

PUA.Win.Packer.Upack-36
Create hunting rule

PUA.Win.Packer.Upack-15
Create hunting rule

PUA.Win.Packer.Upack-4
Create hunting rule

PUA.Win.Packer.Upack-3
Create hunting rule

PUA.Win.Packer.Upack-41
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a process with a hidden window
Creating a file in the Windows directory
Creating a file
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching a process
Running batch commands
Creating a window
Sending a custom TCP request
Modifying an executable file
Enabling the 'hidden' option for recently created files
Launching the process to interact with network services
Enabling autorun
Infecting executable files
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/62ced6960b00dfa734ec78ea/reports/57d7e583-69a9-4263-bcef-256aa51da225/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/62f778e4-f519-4642-b03e-83159a3433f3
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spre.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1030826
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an undocumented autostart registry key
Creates files in the recycle bin to hide itself
Disables security and backup related services
Drops executables to the windows directory (C:\Windows) and starts them
Infects executable files (exe, dll, sys, html)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 663316 Sample: 27LlL4hkF9.com_c3d347e71f7f... Startdate: 14/07/2022 Architecture: WINDOWS Score: 100 65 Snort IDS alert for network traffic 2->65 67 Antivirus detection for dropped file 2->67 69 Antivirus / Scanner detection for submitted sample 2->69 71 3 other signatures 2->71 8 27LlL4hkF9.exe 1 5 2->8         started        process3 file4 43 C:\Windows\rundl132.exe, PE32 8->43 dropped 45 C:\Windows\Logo1_.exe, PE32 8->45 dropped 47 C:\Users\user\Desktop\27LlL4hkF9.exe.exe, PE32 8->47 dropped 73 Creates an undocumented autostart registry key 8->73 75 Drops executables to the windows directory (C:\Windows) and starts them 8->75 77 Disables security and backup related services 8->77 12 Logo1_.exe 112 8->12         started        17 cmd.exe 1 8->17         started        19 net.exe 1 8->19         started        signatures5 process6 dnsIp7 59 192.168.2.1 unknown unknown 12->59 61 192.168.2.10 unknown unknown 12->61 63 74 other IPs or domains 12->63 49 C:\Windows\Dll.dll, PE32 12->49 dropped 51 C:\Program Files\...\msoia.exe, PE32 12->51 dropped 53 C:\Program Files\...\MSOHTMED.EXE, PE32 12->53 dropped 57 9 other malicious files 12->57 dropped 79 Antivirus detection for dropped file 12->79 81 Creates files in the recycle bin to hide itself 12->81 83 Machine Learning detection for dropped file 12->83 85 5 other signatures 12->85 21 net.exe 1 12->21         started        23 net.exe 1 12->23         started        25 explorer.exe 12->25 injected 55 C:\Users\user\Desktop\27LlL4hkF9.exe (copy), PE32 17->55 dropped 27 conhost.exe 17->27         started        29 27LlL4hkF9.exe 17->29         started        31 conhost.exe 19->31         started        33 net1.exe 1 19->33         started        file8 signatures9 process10 process11 35 conhost.exe 21->35         started        37 net1.exe 1 21->37         started        39 conhost.exe 23->39         started        41 net1.exe 1 23->41         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30f1233c3ff4700a11e179f579008b3c9e57d193dede2df2e6b6ee7addd04743/
Threat name:
Win32.Worm.Viking
Create hunting rule
Status:
Malicious
First seen:
2022-07-08 02:37:15 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
39 of 40 (97.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gdysgpb76ryauepbph2xsaelhspfpumt33pc34xgw3xhvxoqi5bq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/220713-rsfcpaada3/
Behaviour
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Enumerates connected drives
Deletes itself
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
e34c6c5104b7ca368a847ef83b586ece7b95bbe2c15e6aa9c4c939c39cc63188
MD5 hash:
6837323ab39043a8d3db91ebf2ed3c31
SHA1 hash:
a542d4fa6076a5a6bc0bf1815f309052f5ad5835
Link:
https://www.unpac.me/results/f8c1e519-b9a7-4e00-baf8-67e05d2f2472/
SH256 hash:
196814081723571d9f9bc1c1ad2d0376566663b1753dd1cc0af74789c562dc47
MD5 hash:
fe7df534e41d455a9e34ac420d03d5b3
SHA1 hash:
8db935bb25c4a5e99afc52d5e12717d97dd8d84d
Link:
https://www.unpac.me/results/f8c1e519-b9a7-4e00-baf8-67e05d2f2472/
SH256 hash:
235c3f911fb6a2fed167fcad7b261ded805d6ed6fc6e19ae823972fabdb05d77
MD5 hash:
42d6e4e8a0237dbb746bc12bbbb2efd1
SHA1 hash:
2a9d0abce9afd0e7dad8e4c27a3cdbbf2b0799af
Link:
https://www.unpac.me/results/f8c1e519-b9a7-4e00-baf8-67e05d2f2472/
SH256 hash:
30f1233c3ff4700a11e179f579008b3c9e57d193dede2df2e6b6ee7addd04743
MD5 hash:
c3d347e71f7f7e37033e6d44609aeef0
SHA1 hash:
ead9a4e386da6baa118656a58bec25dbd6c4b1cc
Link:
https://www.unpac.me/results/f8c1e519-b9a7-4e00-baf8-67e05d2f2472/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/30f1233c3ff4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/30f1233c3ff4700a11e179f579008b3c9e57d193dede2df2e6b6ee7addd04743

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 30f1233c3ff4700a11e179f579008b3c9e57d193dede2df2e6b6ee7addd04743

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/287284/

Comments