MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 343ed81c3b97f9cff2d0ae5fe734dd1849d4d0fd3dd3887cde9ca4186ef91a47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Phonk


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 343ed81c3b97f9cff2d0ae5fe734dd1849d4d0fd3dd3887cde9ca4186ef91a47
SHA3-384 hash: 03af946fc254e9b6eb52cf5bce6776e975ce1730f9a8db9ce9b6b5a38e79e54fcccf016aa5e19637321692e4dfbae74f
SHA1 hash: 7edd64b669f00bc13213867daf87dcd983787048
MD5 hash: 1b54e265ce3b7c65b480ab8014bf326a
humanhash: glucose-sierra-oxygen-don
File name:file
Download: download sample
Signature Phonk
Create hunting rule
File size:3'289'088 bytes
First seen:2023-10-03 08:18:30 UTC
Last seen:2023-10-03 15:25:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:MroptaZwYrKwg6fbPMVJQyh1u2/WoLLfXZ/6pkJbbb0Y:Mrcta0hg2JfUk2
Threatray 527 similar samples on MalwareBazaar
TLSH T139E538447E428D66DE5D22F2DE1E159CDB10DD222F40A29B2AD2F5C9637DAD38C4E383
TrID 40.9% (.EXE) Win64 Executable (generic) (10523/12/4)
19.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
8.0% (.ICL) Windows Icons Library (generic) (2059/9)
7.8% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon e8c88c9eafcada18 (2 x Phonk, 1 x CoinMiner)
Reporter andretavare5
Tags:exe Phonk


Avatar
andretavare5
Sample downloaded from http://enfantfoundation.com/netTime.exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
293
Origin country :
US US
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
https://itfolkstechnology.com/wp-download/zip.7z
Verdict:
Malicious activity
Analysis date:
2023-10-03 15:55:53 UTC
Tags:
privateloader evasion opendir loader gcleaner risepro stealer lumma stealc redline tofsee botnet onlylogger hijackloader amadey trojan smoke fabookie ransomware stop raccoon recordbreaker danabot danabot-unpacked raccoonclipper vidar arkei
Link:
https://app.any.run/tasks/03df17a0-3267-4e12-aa3f-94288002d285

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2228.12795.8400.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm lolbin net_reactor packed replace
Link:
https://www.filescan.io/uploads/651bce771e07d7e1e9aba0c9/reports/939434b5-3aca-4418-a33f-a036267a45be/overview
Verdict:
Malicious
Labled as:
MSIL/Packed.DotNetGuard
Link:
https://www.hybrid-analysis.com/sample/343ed81c3b97f9cff2d0ae5fe734dd1849d4d0fd3dd3887cde9ca4186ef91a47
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a570d82f-4c2d-4265-b2fe-e9335e02caba
Result
Threat name:
Phonk Miner, Xmrig
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1318536
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Drops large PE files
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Phonk Miner
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1318536 Sample: file.exe Startdate: 03/10/2023 Architecture: WINDOWS Score: 100 36 Multi AV Scanner detection for domain / URL 2->36 38 Antivirus detection for URL or domain 2->38 40 Antivirus / Scanner detection for submitted sample 2->40 42 4 other signatures 2->42 9 file.exe 7 2->9         started        13 JQSZY.exe 3 2->13         started        process3 file4 32 C:\ProgramData\x64netJS\JQSZY.exe, PE32+ 9->32 dropped 46 Detected unpacking (changes PE section rights) 9->46 48 Drops large PE files 9->48 15 cmd.exe 1 9->15         started        50 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 13->50 signatures5 process6 signatures7 52 Uses schtasks.exe or at.exe to add and modify task schedules 15->52 18 JQSZY.exe 14 6 15->18         started        22 conhost.exe 15->22         started        24 timeout.exe 1 15->24         started        process8 dnsIp9 34 tradersteampoggx.space 18->34 44 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 18->44 26 cmd.exe 1 18->26         started        signatures10 process11 process12 28 conhost.exe 26->28         started        30 schtasks.exe 1 26->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/343ed81c3b97f9cff2d0ae5fe734dd1849d4d0fd3dd3887cde9ca4186ef91a47/
Threat name:
Win64.Trojan.Privateloader
Create hunting rule
Status:
Suspicious
First seen:
2023-10-03 08:19:05 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
175
AV detection:
14 of 23 (60.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gq7nqhb3s74474wqvzp6ong5dbe5juh5hxjyq7g6tssbq3xzdjdq._file
Verdict:
unknown
Similar samples:
0f6a0c8f4c9d3fa419bd22b2687328e7a721ad0b1ef504a64166b1c630997cee
Phonk
17aef7f33ee1725a500067cf27953fbaaf7ae489c2cf974a0d5a676e454750eb
Phonk
2d397c3b96952610182b2f157200c188b1f816689dda18ab175b813108acce13
Phonk
430086349a61778959cac915344d53138d7b61ab131e4cfa9e3623617a386956
Phonk
bb90c8c39ba60347b2d5f2a73a11f9c1f9f7e16251ca3098e4c087257bcce09b
Phonk
bcd079ed77301cc5f6a0443ccb3c5b4fe4a4b660ad61d5bcc40f0224c8c2da63
Phonk
c6ac860c1c4c54aedf7664c5b173b81b3a766c1bff8a26b4fafb8277b2f725ec
Phonk
cfa0e89054a2c3e47b0f0f036f26639897bfd79977ffce5697910a13136a462d
Phonk
ee4cbbb8c6646ee093819a0e7d7f95f52e9f4951bdaa6d4fbe59f80ed4fdd3af
Phonk
fb9295be3b011faf14a3e3d382a24eb47cf8877f3fcbf2bbc598c92cf3a48181
Phonk
+ 517 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231003-j7t6dshd4w/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
343ed81c3b97f9cff2d0ae5fe734dd1849d4d0fd3dd3887cde9ca4186ef91a47
MD5 hash:
1b54e265ce3b7c65b480ab8014bf326a
SHA1 hash:
7edd64b669f00bc13213867daf87dcd983787048
Link:
https://www.unpac.me/results/089abac4-70fd-49d7-a4b5-f90a66fda011/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BAZT_B5_NOCEXInvalidStream
Create hunting rule
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2715541/

Comments