MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30f166c009214739749ee34b1de5a09dbbb3d94b537a5b37316f31d01c1b60ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	30f166c009214739749ee34b1de5a09dbbb3d94b537a5b37316f31d01c1b60ed
SHA3-384 hash:	97316b6663c11df0aeae19df59cc7bc63a7354314bebd673884a8fab42f0d8234bd13038a19f400eacac70bfcd6fac9f
SHA1 hash:	e8d635d20214c58e302ae1b8064fd61439ee868d
MD5 hash:	bd713350cfd475ad2bb8b5f566af1ac4
humanhash:	delaware-may-three-double
File name:	MarioKartEmuDownloader.zip
Download:	download sample
File size:	96'774 bytes
First seen:	2024-08-30 21:28:49 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	1536:hRnAV/U1H4iCe7LKbF5aQiV3jrtdZi8lenO0Nh/DbE/Dz8cBmhwDRYN4N:h9iUNT7LCb5artdI8cO0NJDg7hBmhSRP
TLSH	T1F493123417C4B99B928FDD20B2BEA841C5D366C10650D52A7876F573311BBA7B02E9C9
Magika	zip
Reporter	Anonymous
Tags:	zip

Anonymous

Retrieved from https://itsthepartything.serv00.net/repo2/MarioKartEmuDownloader.zip

Intelligence

File Origin

# of uploads :

# of downloads :

461

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	Mario Kart Rom Downloader.EXE
File size:	203'264 bytes
SHA256 hash:	e25ffd8251478187f053ab0d2dbb0fc7fdf4ba552ec7d07e6edbc5c74aa68ffd
MD5 hash:	7e0582cd96b1c383885e4f70fcdc3f79
MIME type:	application/x-dosexec

File name:	ReadmeMK.txt
File size:	199 bytes
SHA256 hash:	3de63ddef6311823cc87e11110d02b69fa3919f369ef6d08c0f029ec79d8e5b5
MD5 hash:	e0130bda49b2a45862ae0d4d391eae49
MIME type:	text/plain

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.BACKDOOR.Trojan.2860.9358.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66d239a16011bbdba4e0cc1c

Tags:

Banker Execution Network Static Dropper Dexter

Result

Verdict:

Suspicious

File Type:

PE File

Link:

https://app.docguard.net/30f166c009214739749ee34b1de5a09dbbb3d94b537a5b37316f31d01c1b60ed/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

CAB epmicrosoft_visual_cc installer microsoft_visual_cc sfx

Link:

https://www.filescan.io/uploads/66d2399e3c4b518fb3a53ec0/reports/94505026-8930-41b5-8ed0-f3b459144ea4/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/30f166c009214739749ee34b1de5a09dbbb3d94b537a5b37316f31d01c1b60ed

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/30f166c009214739749ee34b1de5a09dbbb3d94b537a5b37316f31d01c1b60ed

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

52%

Verdict:

Susipicious

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_Redline_Stealer Create hunting rule
Author:	Varp0s

Rule name:	win_redline_wextract_hunting_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects wextract archives related to redline/amadey