MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36194d07ea9897f2276215a1361291ba8e32843caf3056b4f096c213b1bfadb3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	36194d07ea9897f2276215a1361291ba8e32843caf3056b4f096c213b1bfadb3
SHA3-384 hash:	beaf25e65979751285c3feb0f863a873bbaa712e1e55872cc8095807457bd6a191c013fbf69d0c0ba8d5b54c7a2f6051
SHA1 hash:	3cd541ef16e0089dde1192af7b25398c5334846e
MD5 hash:	af223db55c63038d78116cf8aed34b04
humanhash:	king-zebra-lima-oregon
File name:	SecuriteInfo.com.Trojan.Uztuby.4.20085.29220
Download:	download sample
File size:	1'788'270 bytes
First seen:	2023-07-03 19:31:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0ae9e38912ff6bd742a1b9e5c003576a (10 x DCRat, 7 x RedLineStealer, 4 x AsyncRAT)
ssdeep	24576:F/rPkVdKtQBoZUABKUlY0Q1MhhvjdVmOFMZUdNoEiaWpI83X6pxxAcyh/GqIUbcE:Paqbov0Qk1R6qzl526Txo/GqIUDjQa
Threatray	552 similar samples on MalwareBazaar
TLSH	T1D58523033AD4DAB1E5B225336E399B31B63CBD205B65CECFA350695DAC312C0DA34667
TrID	89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.5% (.EXE) Win64 Executable (generic) (10523/12/4) 2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

311

Origin country :

FR

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

SecuriteInfo.com.Trojan.Uztuby.4.20085.29220

Verdict:

Suspicious activity

Analysis date:

2023-07-03 19:33:33 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/900edd89-ce22-4896-a23e-27192aee5f36

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/406186/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Launching a process

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/95427/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm fauppod greyware lolbin overlay packed packed replace setupapi shdocvw shell32

Link:

https://www.filescan.io/uploads/64a32238204315fbc16c8baf/reports/f74a1b86-b510-4f30-9f47-d3043a6d9167/overview

Hybrid Analysis Trojan.Uztuby

Verdict:

Malicious

Labled as:

Trojan.Uztuby

Link:

https://www.hybrid-analysis.com/sample/36194d07ea9897f2276215a1361291ba8e32843caf3056b4f096c213b1bfadb3

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/28f9323f-d6fc-474b-99d3-e3df0675d986

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1266206

Signature

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/36194d07ea9897f2276215a1361291ba8e32843caf3056b4f096c213b1bfadb3/

ReversingLabs TitaniumCloud Win32.Trojan.Amadey

Threat name:

Win32.Trojan.Amadey

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-03 19:32:08 UTC

File Type:

PE (Exe)

Extracted files:

18

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gymu2b7ktcl7ej3ccwqtmeurxkhdfbb4v4yfnnhqs3bbhmn7vwzq._file

Threatray malicious

Verdict:

malicious

Similar samples:

275f2f9c90c3d2df4d0353b1ecc812ad68e0abaf29e901a99a7b768efbff12ad

30f91a9f411187ee24ea1a19d9043c4065707e7c6754c96a8c7ad1fb18ce0d67

33e686777d4e60947c1bc7d7743f006901dd209ae7fa9c6bd3d758dfc9b0aafc

35e5460c102ca2f996d61d70d6bb06fb87014f7d2beccf35f3812ea534acd9d5

8525d0bc1e38bb74d592de9be2615da94ec0b81e611b0e456b3a51c40ab5baa3

e905f262f2ec981ddf92c94fe44d96c14195f9bf0815f204c2c4197b16dbb053

f8a021222ad2ca32a7b3562f643d95401efca4ccd44c814f6107a0c828bee235

fba557d1ea30dc5810637b80408cc8d6491f33e5cb4def703f2b3413d476d93d

+ 542 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230703-x8x6bsbc4w/

Behaviour

Modifies registry class

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

04488d8db44427100ad14ded65f42ebc4389500a77e00c2068fe93484ec10cc2

MD5 hash:

49bf241733b10a78b678afb0737ea744

SHA1 hash:

8437fa9221742c6bd30c3c2afc5e1a6fd50126cd

Link:

https://www.unpac.me/results/ed344901-6401-452f-bde5-c160c89e41ea/

SH256 hash:

36194d07ea9897f2276215a1361291ba8e32843caf3056b4f096c213b1bfadb3

MD5 hash:

af223db55c63038d78116cf8aed34b04

SHA1 hash:

3cd541ef16e0089dde1192af7b25398c5334846e

Link:

https://www.unpac.me/results/ed344901-6401-452f-bde5-c160c89e41ea/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 36194d07ea9897f2276215a1361291ba8e32843caf3056b4f096c213b1bfadb3

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2675870/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/406186/