MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32a7bd36706affb81326833846ef47c41510c0baec68078a6eec71dd38a6d6a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32a7bd36706affb81326833846ef47c41510c0baec68078a6eec71dd38a6d6a9
SHA3-384 hash: 188fea9b6dd5b90a69a5bc90b6343a5b09545ad65b2846fc688d46ea1aafe240910178aa202a1b7d7cb0f717910f610b
SHA1 hash: 33931d3e14cd5db9863dce88b96db8b6214d99dd
MD5 hash: afb607adf73f45a2e3d7d4bc42218603
humanhash: fifteen-one-lamp-south
File name:Fact-NaturgyID2104254SPAINNOPAGO224042494040212042024.msi
Download: download sample
File size:7'859'200 bytes
First seen:2024-04-28 08:52:08 UTC
Last seen:2024-04-28 09:31:48 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:iPd1lxgzIrB/UibfL2StFW+V41PteE0+geEaV5zcteo6:i/lxjXbfKS/W+e1VeE0+Bue
Threatray 5 similar samples on MalwareBazaar
TLSH T1A8868D17B388613EC05A0B3A5877E754983FBFA17A268D5767F4284C4F356802E3EA47
TrID 73.9% (.MSI) Microsoft Windows Installer (454500/1/170)
9.9% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.5% (.MSWMM) Windows Movie Maker project (46500/1/9)
7.2% (.MSP) Windows Installer Patch (44509/10/5)
1.3% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:msi

Intelligence

File Origin
# of uploads :
2
# of downloads :
54
Origin country :
NL NL
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys fingerprint grandoreiro keylogger lolbin packed remote
Link:
https://www.filescan.io/uploads/662e0e70b575a100a233b2fe/reports/7dcb24c4-772c-4600-8848-ed19d291b4b4/overview
Verdict:
Malicious
Labled as:
ABRisk.LEAJ
Link:
https://www.hybrid-analysis.com/sample/32a7bd36706affb81326833846ef47c41510c0baec68078a6eec71dd38a6d6a9
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/32a7bd36706affb81326833846ef47c41510c0baec68078a6eec71dd38a6d6a9
Result
Threat name:
n/a
Detection:
suspicious
Classification:
evad
Score:
30 / 100
Link:
https://www.joesandbox.com/analysis/1432805
Signature
Contains functionality to detect sleep reduction / modifications
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1432805 Sample: Fact-NaturgyID2104254SPAINN... Startdate: 28/04/2024 Architecture: WINDOWS Score: 30 36 cld.pt 2->36 40 Multi AV Scanner detection for dropped file 2->40 42 Multi AV Scanner detection for submitted file 2->42 8 msiexec.exe 9 39 2->8         started        11 YPGAMES.exe 3 2->11         started        13 msiexec.exe 2 2->13         started        signatures3 process4 file5 28 C:\Windows\Installer\MSID2C2.tmp, PE32 8->28 dropped 30 C:\Windows\Installer\MSID149.tmp, PE32 8->30 dropped 32 C:\Windows\Installer\MSICAB1.tmp, PE32 8->32 dropped 34 2 other malicious files 8->34 dropped 15 msiexec.exe 2 22 8->15         started        process6 dnsIp7 38 cld.pt 213.13.26.152, 443, 49710 MEO-RESIDENCIALPT Portugal 15->38 22 C:\vstatic\vcen.dll, PE32 15->22 dropped 24 C:\vstatic\dvdau.dll, PE32 15->24 dropped 26 C:\vstatic\StarBurn.dll, PE32 15->26 dropped 19 YPGAMES.exe 1 3 15->19         started        file8 process9 signatures10 44 Contains functionality to detect sleep reduction / modifications 19->44
Score:
96%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/32a7bd36706affb81326833846ef47c41510c0baec68078a6eec71dd38a6d6a9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32a7bd36706affb81326833846ef47c41510c0baec68078a6eec71dd38a6d6a9/
Threat name:
Win32.Trojan.Barys
Create hunting rule
Status:
Malicious
First seen:
2024-04-24 03:53:02 UTC
File Type:
Binary (Archive)
Extracted files:
136
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gkt32ntqnl73qezgqm4en32hyqkrbqf25ruapcto5ry52ofg22uq._file
Verdict:
malicious
Similar samples:
0519a9ec136042b2527aa3b8a4010941667df52938c2bc716877c4863be3b314
32a7bd36706affb81326833846ef47c41510c0baec68078a6eec71dd38a6d6a9
9dbf6adf78853fbd71251606f5295f185ab787eec6e3ca3b80261649ee59a05f
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/240428-kta12acb36/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Loads dropped DLL
Enumerates connected drives
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/32a7bd36706affb81326833846ef47c41510c0baec68078a6eec71dd38a6d6a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_LATAM_MSI_Banker
Create hunting rule
Rule name:Excel_Hidden_Macro_Sheet
Create hunting rule
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments