MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3489e98fe4da2b3e14d88e196ffcc1955c1fbe5361ed7fbb96605207898a9d25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3489e98fe4da2b3e14d88e196ffcc1955c1fbe5361ed7fbb96605207898a9d25
SHA3-384 hash: d6599fe16d8fc52c26ec1bbe69dd67d634c04f20cd440bd7aa8d373c8257b53b8e5ed53fb8d0a63a87383e92e4655602
SHA1 hash: 07cd4cc9bb857626b11d5247a627de178e9c9530
MD5 hash: d00005570c580c101c85b9a49c5c6804
humanhash: virginia-nineteen-undress-blue
File name:SecuriteInfo.com.Trojan.MulDrop21.12500.14020.14828
Download: download sample
File size:1'350'144 bytes
First seen:2024-01-23 08:18:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 430c254a14c8793a3fde9cbb05ad273c
ssdeep 24576:NjkPgi1+XJEx7/EEjXvRvItZJdX3p9hHPcrfd4JW+B:NQjIi7ME7Jvw/9tS4s+
Threatray 4 similar samples on MalwareBazaar
TLSH T1C555E106F3A418F9E4778138C8628A02E672BC5A0771CFDF23A466565F376D0AD3EB51
TrID 72.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
13.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.5% (.EXE) OS/2 Executable (generic) (2029/13)
2.5% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
301
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/472455/
Detection(s):
SecuriteInfo.com.Trojan.MulDrop21.12500.14020.14828.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the Windows subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file
Creating a service
Loading a system driver
Creating a file in the %temp% directory
Enabling autorun for a service
Unauthorized injection to a recently created process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
explorer fingerprint hook lolbin packed setupapi shell32
Link:
https://www.filescan.io/uploads/65af7649f3cf17c17b769b39/reports/8cb580ed-2aed-4459-b0a0-646dd3d93938/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/3489e98fe4da2b3e14d88e196ffcc1955c1fbe5361ed7fbb96605207898a9d25
Malware family:
Mimikatz
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/960cc0db-0fc1-47a2-955e-b6ff9d2a5d5d
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1379328
Signature
Antivirus / Scanner detection for submitted sample
Drops executables to the windows directory (C:\Windows) and starts them
Found driver which could be used to inject code into processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3489e98fe4da2b3e14d88e196ffcc1955c1fbe5361ed7fbb96605207898a9d25
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3489e98fe4da2b3e14d88e196ffcc1955c1fbe5361ed7fbb96605207898a9d25/
Threat name:
Win64.Dropper.Convagent
Create hunting rule
Status:
Malicious
First seen:
2022-11-14 23:41:21 UTC
File Type:
PE+ (Exe)
Extracted files:
17
AV detection:
27 of 38 (71.05%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gse6td7e3ivt4fgyrymw77gbsvob7pstmhwx7o4wmbjapcmktusq._file
Verdict:
malicious
Similar samples:
05988fb3d7052f1052afa81f512114e1bed89c116d4878d3250f0c16475e0249
58917febd1aae433e3522df0749d82d14906a6bf249b90521b5cdacff2208cde
7f74a54ab8c6cfff77d857e4b8c4b9fdb95a701569d007c8886b343d55870b0f
e180397de1d16feacea7a305fcefefb5b307b241dadc30d942a4fd2e1ebc51bf
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/240123-j7eqpsgfhl/
Behaviour
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Sets service image path in registry
Gathering data
Malware family:
Mimikatz
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3489e98fe4da/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3489e98fe4da2b3e14d88e196ffcc1955c1fbe5361ed7fbb96605207898a9d25

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/472455/

Comments