🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31fe609d807d86af4eb823355faf35969ecfa5f2cfff265909d6348c5644e79d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31fe609d807d86af4eb823355faf35969ecfa5f2cfff265909d6348c5644e79d
SHA3-384 hash: bb32b2a429ea35b999757ecb8bad08f21f1e7558a5ed0554203db26c45dd812094782feaecea8d2ac055f8ed57b8da08
SHA1 hash: a6f05208b7b3d46b44cd8d413ab782fd38dc843c
MD5 hash: e061b4b19ab70e99e11fb764b7a8e6ed
humanhash: undress-princess-floor-avocado
File name:iyi
Download: download sample
File size:3'348'992 bytes
First seen:2023-11-22 21:41:11 UTC
Last seen:2023-11-22 23:28:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 071337bdac48f0dfbad94960251bde83
ssdeep 24576:I1dyyz8mJsZg1kIFSBUlnOFhBc1OBwNN685bqgaiKSbb9Z7GpcFz9srUpBf:I1dJsZ2FxnOb7cpXTZscMwp
TLSH T14CF52632E06879D5C4780E309B6767F04BDB8E613452CDE727A4412F42BF2AB235A767
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon f0968ee8aae8e8b2 (13 x ValleyRAT, 9 x Urelas, 5 x HermeticWiper)
Reporter Anonymous
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
338
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/459767/
Detection(s):
SecuriteInfo.com.Win32.DropperX-gen.15595.4383.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
Enabling the 'hidden' option for analyzed file
Creating a process with a hidden window
Creating a file
Launching a process
Running batch commands
Searching for synchronization primitives
Using the Windows Management Instrumentation requests
Creating a file in the system32 subdirectories
Changing a file
DNS request
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/655e75ad4ad9ae08369c3f11/reports/7fd8fa49-80ec-4691-9190-3f796a72154b/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/31fe609d807d86af4eb823355faf35969ecfa5f2cfff265909d6348c5644e79d
Malware family:
Mesa 3D
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d4a1da9a-7ce7-4f64-9de9-879eb9eb2f44
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
44 / 100
Link:
https://www.joesandbox.com/analysis/1346621
Signature
Contain functionality to detect virtual machines
Creates an autostart registry key pointing to binary in C:\Windows
Deletes itself after installation
DLL side loading technique detected
Found API chain indicative of debugger detection
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
System process connects to network (likely due to code injection or exploit)
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1346621 Sample: iyi.exe Startdate: 22/11/2023 Architecture: WINDOWS Score: 44 80 Multi AV Scanner detection for submitted file 2->80 82 Machine Learning detection for sample 2->82 84 Yara detected Generic Downloader 2->84 8 ProgressBar.exe 5 2->8         started        11 iyi.exe 2 3 2->11         started        14 cleanmgr.exe 2->14         started        16 cleanmgr.exe 2->16         started        process3 file4 64 C:\Users\user\AppData\Local\...\Update.exe, PE32 8->64 dropped 18 Update.exe 525 502 8->18         started        66 C:\Users\user\AppData\...\ProgressBar.exe, PE32 11->66 dropped 68 C:\Users\user\AppData\Local\...\CleanUp.dll, PE32 11->68 dropped 92 Self deletion via cmd or bat file 11->92 94 Creates an autostart registry key pointing to binary in C:\Windows 11->94 96 Deletes itself after installation 11->96 22 cleanmgr.exe 11 32 11->22         started        25 ProgressBar.exe 11->25         started        27 cmd.exe 11->27         started        98 DLL side loading technique detected 14->98 29 rundll32.exe 14->29         started        signatures5 process6 dnsIp7 70 13.89.179.8 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 18->70 72 20.42.73.28 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 18->72 74 4 other IPs or domains 18->74 56 C:\Users\user\AppData\Local\...\Squirrel.exe, PE32 18->56 dropped 58 C:\Users\user\AppData\Local\...\Update.exe, PE32 18->58 dropped 60 C:\Users\user\AppData\Local\...\vulkan-1.dll, PE32+ 18->60 dropped 62 346 other files (none is malicious) 18->62 dropped 31 Teams.exe 18->31         started        33 Teams.exe 18->33         started        35 regsvr32.exe 18->35         started        43 2 other processes 18->43 86 Contain functionality to detect virtual machines 25->86 37 conhost.exe 27->37         started        88 Found API chain indicative of debugger detection 29->88 39 rundll32.exe 29->39         started        file8 signatures9 process10 dnsIp11 45 Teams.exe 31->45         started        48 Teams.exe 31->48         started        50 Teams.exe 33->50         started        52 Teams.exe 33->52         started        54 regsvr32.exe 35->54         started        76 91.240.118.215 GLOBALLAYERNL unknown 39->76 90 System process connects to network (likely due to code injection or exploit) 39->90 signatures12 process13 dnsIp14 78 172.64.41.3 CLOUDFLARENETUS United States 45->78
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/31fe609d807d86af4eb823355faf35969ecfa5f2cfff265909d6348c5644e79d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31fe609d807d86af4eb823355faf35969ecfa5f2cfff265909d6348c5644e79d/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-11-22 17:17:18 UTC
File Type:
PE (Exe)
Extracted files:
33
AV detection:
17 of 23 (73.91%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gh7gbhmapwdk6tvyem2v7lzvs2pm7jpsz77smwij2y2iyvse46oq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/231122-1kbh7sfe2w/
Behaviour
Checks processor information in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks system information in the registry
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Deletes itself
Executes dropped EXE
Loads dropped DLL
Registers COM server for autorun
Blocklisted process makes network request
Unpacked files
SH256 hash:
930188365dfd879a46931cb8eac680db0fdc8b10dc92503e58502351f268ddec
MD5 hash:
ee51fc26d4ecbb1d81f6f183d274ea7f
SHA1 hash:
d67cd582255661fdb4548d2afcaa604c91954cb9
Link:
https://www.unpac.me/results/9ab873fc-cae0-4c28-97dd-cae0114f5de4/
SH256 hash:
31fe609d807d86af4eb823355faf35969ecfa5f2cfff265909d6348c5644e79d
MD5 hash:
e061b4b19ab70e99e11fb764b7a8e6ed
SHA1 hash:
a6f05208b7b3d46b44cd8d413ab782fd38dc843c
Link:
https://www.unpac.me/results/9ab873fc-cae0-4c28-97dd-cae0114f5de4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/31fe609d807d86af4eb823355faf35969ecfa5f2cfff265909d6348c5644e79d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/459767/

Comments