MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35396cd9c37aef5c360393e391bbb2acb4956c948e2d061705728002edc068c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Chthonic


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35396cd9c37aef5c360393e391bbb2acb4956c948e2d061705728002edc068c1
SHA3-384 hash: 68227e0034b1c6d980d15a17ef3b7be4148af47b1d92ea6d43c15cd8d35400e623029a53a62cfdbfce0195de7e683e81
SHA1 hash: d396236df73c7d15cf910d6ce3ff4bb75d7e1ebe
MD5 hash: 20634b0d4225cd3d911daf828cb6aa39
humanhash: princess-kilo-johnny-kilo
File name:chthonic_2.23.17.5.vir
Download: download sample
Signature Chthonic
Create hunting rule
File size:123'392 bytes
First seen:2020-07-19 17:28:42 UTC
Last seen:2020-07-19 19:18:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 94c036b7132f046797f2549f9bb50948 (1 x Chthonic)
ssdeep 3072:Dl780tzYUtG2t+jEcW6slZor/Hsd2iwogEtgN:De06wsAZaH99
Threatray 37 similar samples on MalwareBazaar
TLSH 4FC3029F69A88031C91314F1E451FC3B94AFC6342A67E8B5E2E546C257E7127FCE901A
Reporter tildedennis
Tags:Chthonic


Avatar
tildedennis
chthonic version 2.23.17.5

Intelligence

File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/28000/
Detection(s):
SecuriteInfo.com.Downloader.Small.RVO.5435.4197.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
Unknown
Detection:
malicious
Classification:
phis.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/389853
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247101 Sample: chthonic_2.23.17.5.vir Startdate: 19/07/2020 Architecture: WINDOWS Score: 100 103 Antivirus / Scanner detection for submitted sample 2->103 105 Multi AV Scanner detection for submitted file 2->105 107 Machine Learning detection for sample 2->107 109 2 other signatures 2->109 12 chthonic_2.23.17.5.exe 1 2->12         started        17 msbuild_.exe 1 2->17         started        19 msbuild_.exe 1 2->19         started        process3 dnsIp4 101 2.23.17.5 SEABONE-NETTELECOMITALIASPARKLESpAIT European Union 12->101 91 C:\Users\user\AppData\Local\Temp\3E32.tmp, PE32 12->91 dropped 131 Writes to foreign memory regions 12->131 21 msiexec.exe 1 4 12->21         started        93 C:\Users\user\AppData\Local\Temp\CC2A.tmp, PE32 17->93 dropped 25 msiexec.exe 2 17->25         started        95 C:\Users\user\AppData\Local\Temp0EA.tmp, PE32 19->95 dropped 27 msiexec.exe 2 19->27         started        file5 signatures6 process7 file8 83 C:\Users\user\AppData\...\msbuild_.exe, PE32 21->83 dropped 85 C:\Users\user\AppData\Local\Temp\84EF.tmp, PE32 21->85 dropped 125 Creates multiple autostart registry keys 21->125 127 Deletes itself after installation 21->127 129 Hides that the sample has been downloaded from the Internet (zone.identifier) 21->129 29 cmd.exe 1 21->29         started        87 C:\Users\user\AppData\Local\Temp\20E1.tmp, PE32 25->87 dropped 31 cmd.exe 1 25->31         started        89 C:\Users\user\AppData\Local\Temp\3246.tmp, PE32 27->89 dropped 33 cmd.exe 27->33         started        signatures9 process10 process11 35 msbuild_.exe 1 29->35         started        39 conhost.exe 29->39         started        41 msbuild_.exe 1 31->41         started        43 conhost.exe 31->43         started        45 msbuild_.exe 33->45         started        47 conhost.exe 33->47         started        file12 77 C:\Users\user\AppData\Local\Temp\A95F.tmp, PE32 35->77 dropped 119 Antivirus detection for dropped file 35->119 121 Machine Learning detection for dropped file 35->121 123 Writes to foreign memory regions 35->123 49 msiexec.exe 76 2 35->49         started        79 C:\Users\user\AppData\Local\Temp\7CDC.tmp, PE32 41->79 dropped 53 msiexec.exe 41->53         started        81 C:\Users\user\AppData\Local\Temp\FE41.tmp, PE32 45->81 dropped 55 msiexec.exe 45->55         started        signatures13 process14 file15 75 C:\Users\user\AppData\Local\Temp\32D3.tmp, PE32 49->75 dropped 111 Creates an undocumented autostart registry key 49->111 113 Hides the Windows control panel from the task bar 49->113 115 Disables Windows Defender (deletes autostart) 49->115 117 5 other signatures 49->117 57 cmd.exe 1 49->57         started        59 cmd.exe 49->59         started        signatures16 process17 process18 61 msbuild_.exe 1 57->61         started        65 conhost.exe 57->65         started        67 msbuild_.exe 59->67         started        69 conhost.exe 59->69         started        file19 97 C:\Users\user\AppData\Local\Temp\5E86.tmp, PE32 61->97 dropped 133 Writes to foreign memory regions 61->133 71 msiexec.exe 61->71         started        99 C:\Users\user\AppData\Local\Temp\B774.tmp, PE32 67->99 dropped 73 msiexec.exe 67->73         started        signatures20 process21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35396cd9c37aef5c360393e391bbb2acb4956c948e2d061705728002edc068c1/
Threat name:
Win32.Trojan.Chthonic
Create hunting rule
Status:
Malicious
First seen:
2018-06-22 20:01:00 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
248ecff90346c947fda3ab80b686cdb4a3ea72ce5641a17e72b3cd48262d0b69
Chthonic
3b1309d5b6b22786209cd378d53cccc323b33ae5e75dac3e07e53b32c46e67d3
Chthonic
5717e18c6e9c6970f2ccefd15363918464d0662eb016c5b89fb9169339aa338c
Chthonic
9d4746373e81656ca55f49d1b2c93f5d9358bf3c6a31e1a9ae606f26ba273dca
Chthonic
b6f9f9fa970bf7ec730e0944b1bb0ba8d17a3715de0730bc417aae149ae048dd
Chthonic
bbeaa86003be4d14ff5643c47d20ca8a44e4d7e655bda8a93439fbe7dd4e9066
Chthonic
c79649b70f1680062355e956dcabe0fa2ecb58faf5c22d4454a3dbb67e1db6b7
Chthonic
d6324644c2a267bea0322c4f817b7a4029129e68959cdeb25f53f8e1f9ddeaad
Chthonic
ebcb76212a57b469c83b1893f3b22c4199e8726495b057e2c45b3ce146f8d4cc
Chthonic
fd224776b4fb97e51e1d9071c78e506a40c3973e5552ec1ae756fa370363b59d
Chthonic
+ 27 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence evasion trojan ransomware bootkit
Link:
https://tria.ge/reports/200719-be3mte5eq2/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies registry class
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Modifies Internet Explorer settings
Suspicious behavior: GetForegroundWindowSpam
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
System policy modification
Suspicious use of WriteProcessMemory
Modifies registry class
System policy modification
Suspicious behavior: GetForegroundWindowSpam
Modifies service
Modifies service
Checks for any installed AV software in registry
Adds Run key to start application
Checks whether UAC is enabled
Checks for any installed AV software in registry
Adds Run key to start application
Checks whether UAC is enabled
Deletes itself
Loads dropped DLL
Loads dropped DLL
Deletes itself
Executes dropped EXE
Disables taskbar notifications via registry modification
Disables taskbar notifications via registry modification
Executes dropped EXE
Modifies WinLogon to allow AutoLogon
Modifies Windows Defender Real-time Protection settings
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/35396cd9c37aef5c360393e391bbb2acb4956c948e2d061705728002edc068c1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://zeusmuseum.com/chthonic/
Cape
Cape
https://www.capesandbox.com/analysis/28000/

Comments