MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35efc0520b78a1b413afee5dbe5d8b0674eea2acfc7d943de70a99b5b2fd92ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35efc0520b78a1b413afee5dbe5d8b0674eea2acfc7d943de70a99b5b2fd92ef
SHA3-384 hash: 7e69c79f2577094ea32b888f18b28f9e11372505880511193eb920bd67778de676aa133ce3516d4c41b6441601830476
SHA1 hash: 8eac6fb5415f9338b1b131c42ed15ea70da22096
MD5 hash: ffc2637acde7b6db1823a2b3304a6c6c
humanhash: cup-idaho-romeo-whiskey
File name:ffc2637acde7b6db1823a2b3304a6c6c.exe
Download: download sample
File size:110'592 bytes
First seen:2021-11-16 20:37:51 UTC
Last seen:2025-02-21 11:25:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'750 x AgentTesla, 19'656 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 1536:EVqUUq4GE1NKH9GUgki0FKACj0oT11dRb461afxtcUB7Y0gksVx4imclhR93Me:Hq4dkFKLT11TI3cUB00gksz4i9lxMe
Threatray 172 similar samples on MalwareBazaar
TLSH T194B3196732824B21C9892975C1E7587003F2BB87B333D6443F955ACB1D923E69E8EBC5
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/206630/
Detection(s):
SecuriteInfo.com.Variant.Lazy.13536.25605.11651.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Using the Windows Management Instrumentation requests
Creating a file
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/619416b22695a62af9f18c8d/reports/88b70f8a-5ed1-4a8a-a252-67a2e933de84/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6c65d368-3d95-45db-beb3-e50a27d7f2e1
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/890723
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35efc0520b78a1b413afee5dbe5d8b0674eea2acfc7d943de70a99b5b2fd92ef/
Threat name:
ByteCode-MSIL.Trojan.Lazy
Create hunting rule
Status:
Malicious
First seen:
2021-11-16 20:38:08 UTC
AV detection:
13 of 27 (48.15%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
3959233284f7f4a7bec2a314820e3b8e073591a31dfe8c43a03f7a24833b7fd3
3fc706ce01f2ff41e02943699351d1ad3c32160cbd0be0b8bb85f9472303d4c2
51e6527daa5a10028c434c7ceaed1570ddd95e1de0eafa702f77860cec3d0b7c
70c61a7220e7df5841fded5bafa8340c388440911f8c894b35872188f300f29d
766d8e9d2d0de0a0ba2440a847e7eb7da3e69d51331e15a61ec1d25d3d92fc3e
831d7b676bb75c44df50f40798fe739cb07d4c0b1ee217a7e8fea443f7b00346
a341b8f10a51457c11292173cfa48fe49256c9ccef8ec045753b49b2bfa935d6
c1dfcbaabdd34ccb5257c2856121211485293a7a11a23f61c50440fb27eb2b4f
ffec1862f56857ad722abbcb98be7af86f2cf0763371bcb40273f0d884157c32
+ 162 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211116-zeqkhafde4/
Behaviour
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
35efc0520b78a1b413afee5dbe5d8b0674eea2acfc7d943de70a99b5b2fd92ef
MD5 hash:
ffc2637acde7b6db1823a2b3304a6c6c
SHA1 hash:
8eac6fb5415f9338b1b131c42ed15ea70da22096
Link:
https://www.unpac.me/results/822a4949-4fe5-44f3-9665-dd73b16a3436/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.53
Link:
https://yomi.yoroi.company/submissions/35efc0520b78a1b413afee5dbe5d8b0674eea2acfc7d943de70a99b5b2fd92ef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 35efc0520b78a1b413afee5dbe5d8b0674eea2acfc7d943de70a99b5b2fd92ef

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1657096/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/206630/

Comments