🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32f4b7b56845b1c68dc066389ec709d48835150e6f8781cb938836ea381b88a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Lazarus


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32f4b7b56845b1c68dc066389ec709d48835150e6f8781cb938836ea381b88a3
SHA3-384 hash: f18ce1b28c20e5d068d01c57a0a631a382b564716ec024731b7a500b93a49f41e3d571813cba235a717811da4120f63e
SHA1 hash: 56029454d2616c57830f081ff552484b7f5c4cfd
MD5 hash: 86b415dbf3bf56a7b03e5625a6139de7
humanhash: north-nebraska-alpha-south
File name:32f4b7b56845b1c68dc066389ec709d48835150e6f8781cb938836ea381b88a3.vhd
Download: download sample
Signature Lazarus
Create hunting rule
File size:13'632'000 bytes
First seen:2022-11-24 11:15:17 UTC
Last seen:Never
File type:
MIME type:application/octet-stream
Note:This file is a password protected archive. The password is: Lazarus
ssdeep 98304:nGofBLWN29gDeqzHCtYSJ8e9gDeqzHCtYS:nGoNW3HCt7meW3HCt7
TLSH T15ED69D12F609C823D05442B4622D7B62D668BD365B6204C7F7CC3E6867F26D3B961E3B
Reporter JAMESWT_WT
Tags:Lazarus vhd

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
IT IT
File Archive Information

This file archive contains 14 file(s), sorted by their relevance:

File name:$TxfLog.blf
File size:65'536 bytes
SHA256 hash: 576e2c02361eb2ac6f1338bc877a317618221b20027f438ebf50b95f1033089e
MD5 hash: 91ea1fcef8e6c3b9743553adcb1dd7a9
MIME type:image/x-tga
Signature Lazarus
File name:$UpCase:$Info
File size:32 bytes
SHA256 hash: 77f685d9ba6ed843c1c956ee5917e56ffe1dc9ed7c73f0f8e07b861617a48dcc
MD5 hash: 0c633a63eed7554901d1f07bad1d8c14
MIME type:application/octet-stream
Signature Lazarus
File name:IndexerVolumeGuid
File size:76 bytes
SHA256 hash: 0c53e11892fdd5ec99bde7a4993bc7e0fb5f8b9ca5ca3a760fe5414a286b60c9
MD5 hash: edc17163ab393e18983563d3118f3a34
MIME type:application/octet-stream
Signature Lazarus
File name:$Bitmap
File size:320 bytes
SHA256 hash: afff7e51aff4d4fa7442eeaced503cddbe1bdf2609f097de62db80f650d082c3
MD5 hash: 122480e6af6bc78d0888311080cd7a22
MIME type:application/octet-stream
Signature Lazarus
File name:$LogFile
File size:2'097'152 bytes
SHA256 hash: 378bd54ffd65774f850afb23aba8140e53f06a61d49618a58974f22c5dc064f8
MD5 hash: b45593a6d7d554034996d7891d949ce3
MIME type:application/octet-stream
Signature Lazarus
File name:$MFTMirr
File size:4'096 bytes
SHA256 hash: 5a4571104db1551e44bfd91320b16ff52565fd255e0aec5c5587990066be8248
MD5 hash: 0bb563835b3614b345352129f062c380
MIME type:application/octet-stream
Signature Lazarus
File name:$MFT
File size:262'144 bytes
SHA256 hash: 5915dea30ce4e7be93b9f006a71bdbcf1f8907e7b54a772a366bcc0aa2cec351
MD5 hash: 04e12853446924d2283f938780c02201
MIME type:application/octet-stream
Signature Lazarus
File name:$Boot
File size:8'192 bytes
SHA256 hash: 74560162d5d35967f4715708f143ac8423f121bc67514d9a90242f1ea27e43b0
MD5 hash: ec4014f860af68e141b67964ba486c03
MIME type:application/octet-stream
Signature Lazarus
File name:$Tops:$T
File size:1'048'576 bytes
SHA256 hash: 30e14955ebf1352266dc2ff8067e68104607e750abb9d3b36582b8af909fcb58
MD5 hash: b6d81b360a5672d80c27430f39153e2c
MIME type:application/octet-stream
Signature Lazarus
File name:$Secure:$SDS
File size:264'708 bytes
SHA256 hash: fb59c53abe04cf5331eaf80a7cfa3fd3cefff3104735afc9cbfc608d3e32ca1f
MD5 hash: 6f4ce586c48a97f93bb5057bbc1d6bc6
MIME type:application/octet-stream
Signature Lazarus
File name:$AttrDef
File size:2'560 bytes
SHA256 hash: d7de5b1b2f79f45f235ceb1adbc46908ed64eae174eb90ed66aefe5f25165da3
MD5 hash: ad617ac3906958de35eacc3d90d31043
MIME type:application/octet-stream
Signature Lazarus
File name:$Tops
File size:100 bytes
SHA256 hash: 989ce04ceaa64da9d30df0ae1e2dc0573047174f75881b0ccc23ee683abbff99
MD5 hash: 0ec0c2850da284cc448a7ed62fe0bdc4
MIME type:application/octet-stream
Signature Lazarus
File name:$UpCase
File size:131'072 bytes
SHA256 hash: 41c26bc7a12bdaeb26025c93118697c7e3ef81ee048b00fe5cce2a472e0e0742
MD5 hash: 7ff498a44e45e77374cc7c962b1b92f2
MIME type:image/x-tga
Signature Lazarus
File name:WPSettings.dat
File size:12 bytes
SHA256 hash: 67384e6be7897bda9eeb546a78b6b0bcb3b614e1279a128f0098a1918f977bde
MD5 hash: 66947a5c034670af9a00be2fef9cf4db
MIME type:application/octet-stream
Signature Lazarus
Vendor Threat Intelligence
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/637f527a94f9bac087b338bd/reports/a9c2428b-8cfb-474b-9ded-4174d1ea53c9/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32f4b7b56845b1c68dc066389ec709d48835150e6f8781cb938836ea381b88a3/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gl2lpnliiwy4ndoamy4j5ryj2sedkfion6dyds4tra3ouoa3rcrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/32f4b7b56845b1c68dc066389ec709d48835150e6f8781cb938836ea381b88a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Adfind
Create hunting rule
Author:@bartblaze
Description:Identifies Adfind, a Command line Active Directory query tool.
Reference:http://www.joeware.net/freetools/tools/adfind/
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments