MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35396cd9c37aef5c360393e391bbb2acb4956c948e2d061705728002edc068c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 35396cd9c37aef5c360393e391bbb2acb4956c948e2d061705728002edc068c1
SHA3-384 hash: 68227e0034b1c6d980d15a17ef3b7be4148af47b1d92ea6d43c15cd8d35400e623029a53a62cfdbfce0195de7e683e81
SHA1 hash: d396236df73c7d15cf910d6ce3ff4bb75d7e1ebe
MD5 hash: 20634b0d4225cd3d911daf828cb6aa39
humanhash: princess-kilo-johnny-kilo
File name:chthonic_2.23.17.5.vir
Download: download sample
Signature Chthonic
File size:123'392 bytes
First seen:2020-07-19 17:28:42 UTC
Last seen:2020-07-19 19:18:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 94c036b7132f046797f2549f9bb50948
ssdeep 3072:Dl780tzYUtG2t+jEcW6slZor/Hsd2iwogEtgN:De06wsAZaH99
TLSH 4FC3029F69A88031C91314F1E451FC3B94AFC6342A67E8B5E2E546C257E7127FCE901A
Reporter @tildedennis
Tags:Chthonic


Twitter
@tildedennis
chthonic version 2.23.17.5

Intelligence


File Origin
# of uploads :
2
# of downloads :
18
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
Unknown
Detection:
malicious
Classification:
phis.evad
Score:
100 / 100
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247101 Sample: chthonic_2.23.17.5.vir Startdate: 19/07/2020 Architecture: WINDOWS Score: 100 103 Antivirus / Scanner detection for submitted sample 2->103 105 Multi AV Scanner detection for submitted file 2->105 107 Machine Learning detection for sample 2->107 109 2 other signatures 2->109 12 chthonic_2.23.17.5.exe 1 2->12         started        17 msbuild_.exe 1 2->17         started        19 msbuild_.exe 1 2->19         started        process3 dnsIp4 101 2.23.17.5 SEABONE-NETTELECOMITALIASPARKLESpAIT European Union 12->101 91 C:\Users\user\AppData\Local\Temp\3E32.tmp, PE32 12->91 dropped 131 Writes to foreign memory regions 12->131 21 msiexec.exe 1 4 12->21         started        93 C:\Users\user\AppData\Local\Temp\CC2A.tmp, PE32 17->93 dropped 25 msiexec.exe 2 17->25         started        95 C:\Users\user\AppData\Local\Temp0EA.tmp, PE32 19->95 dropped 27 msiexec.exe 2 19->27         started        file5 signatures6 process7 file8 83 C:\Users\user\AppData\...\msbuild_.exe, PE32 21->83 dropped 85 C:\Users\user\AppData\Local\Temp\84EF.tmp, PE32 21->85 dropped 125 Creates multiple autostart registry keys 21->125 127 Deletes itself after installation 21->127 129 Hides that the sample has been downloaded from the Internet (zone.identifier) 21->129 29 cmd.exe 1 21->29         started        87 C:\Users\user\AppData\Local\Temp\20E1.tmp, PE32 25->87 dropped 31 cmd.exe 1 25->31         started        89 C:\Users\user\AppData\Local\Temp\3246.tmp, PE32 27->89 dropped 33 cmd.exe 27->33         started        signatures9 process10 process11 35 msbuild_.exe 1 29->35         started        39 conhost.exe 29->39         started        41 msbuild_.exe 1 31->41         started        43 conhost.exe 31->43         started        45 msbuild_.exe 33->45         started        47 conhost.exe 33->47         started        file12 77 C:\Users\user\AppData\Local\Temp\A95F.tmp, PE32 35->77 dropped 119 Antivirus detection for dropped file 35->119 121 Machine Learning detection for dropped file 35->121 123 Writes to foreign memory regions 35->123 49 msiexec.exe 76 2 35->49         started        79 C:\Users\user\AppData\Local\Temp\7CDC.tmp, PE32 41->79 dropped 53 msiexec.exe 41->53         started        81 C:\Users\user\AppData\Local\Temp\FE41.tmp, PE32 45->81 dropped 55 msiexec.exe 45->55         started        signatures13 process14 file15 75 C:\Users\user\AppData\Local\Temp\32D3.tmp, PE32 49->75 dropped 111 Creates an undocumented autostart registry key 49->111 113 Hides the Windows control panel from the task bar 49->113 115 Disables Windows Defender (deletes autostart) 49->115 117 5 other signatures 49->117 57 cmd.exe 1 49->57         started        59 cmd.exe 49->59         started        signatures16 process17 process18 61 msbuild_.exe 1 57->61         started        65 conhost.exe 57->65         started        67 msbuild_.exe 59->67         started        69 conhost.exe 59->69         started        file19 97 C:\Users\user\AppData\Local\Temp\5E86.tmp, PE32 61->97 dropped 133 Writes to foreign memory regions 61->133 71 msiexec.exe 61->71         started        99 C:\Users\user\AppData\Local\Temp\B774.tmp, PE32 67->99 dropped 73 msiexec.exe 67->73         started        signatures20 process21
Threat name:
Win32.Trojan.Chthonic
Status:
Malicious
First seen:
2018-06-22 20:01:00 UTC
AV detection:
27 of 31 (87.10%)
Threat level
  5/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence evasion trojan ransomware bootkit
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies registry class
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Modifies Internet Explorer settings
Suspicious behavior: GetForegroundWindowSpam
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
System policy modification
Suspicious use of WriteProcessMemory
Modifies registry class
System policy modification
Suspicious behavior: GetForegroundWindowSpam
Modifies service
Modifies service
Checks for any installed AV software in registry
Adds Run key to start application
Checks whether UAC is enabled
Checks for any installed AV software in registry
Adds Run key to start application
Checks whether UAC is enabled
Deletes itself
Loads dropped DLL
Loads dropped DLL
Deletes itself
Executes dropped EXE
Disables taskbar notifications via registry modification
Disables taskbar notifications via registry modification
Executes dropped EXE
Modifies WinLogon to allow AutoLogon
Modifies Windows Defender Real-time Protection settings
Threat name:
Unknown
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments