MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36417eb2ecdbb537b9679f959a8ab356e954f1a1ae200a360f7fed963c8d04e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Metamorfo

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments 1

SHA256 hash:	36417eb2ecdbb537b9679f959a8ab356e954f1a1ae200a360f7fed963c8d04e2
SHA3-384 hash:	640ed5714cd9be816eb3bd9932e45be28d294f07d070d05ed6b5e85b81032f48447a132904cdc11424f86de758a4be83
SHA1 hash:	3d7412f2aae4e578712a19fedd5994aab0afee52
MD5 hash:	73f1227353bf94e9e829088b81cd25fa
humanhash:	autumn-carolina-hotel-helium
File name:	73f1227353bf94e9e829088b81cd25fa
Download:	download sample
Signature	Metamorfo Create hunting rule
File size:	269'824 bytes
First seen:	2021-09-30 15:23:38 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	3072:zmY6a39m3DcYoAQwgz88ereWn/7w05g0WMcB3RUN46ILJ9+ZB5yOan8u:zmYS3DcYoAh8er1nzT7rXu
TLSH	T191447D06B3D5437AE4DB02722B8F93628A72EC788673412B1649750E3EF1554B7B73E2
Reporter	zbetcheckin
Tags:	MetaMorfo msi

Intelligence

File Origin

# of uploads :

# of downloads :

205

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/193727/

Detection(s):

SecuriteInfo.com.RDMK.cmRtazpKxKzi0pVLtXUmAmezzdjf.17904.UNOFFICIAL

SecuriteInfo.com.JS.Obfus-679.UNOFFICIAL

SecuriteInfo.com.JS.Obfus-1914.UNOFFICIAL

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/36417eb2ecdbb537b9679f959a8ab356e954f1a1ae200a360f7fed963c8d04e2

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/36417eb2ecdbb537b9679f959a8ab356e954f1a1ae200a360f7fed963c8d04e2/

Threat name:

Script-JS.Downloader.Bomber

Status:

Malicious

First seen:

2021-09-30 15:24:29 UTC

AV detection:

7 of 45 (15.56%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gzax5mxm3o2tpolht6kzvcvtk3uvj4nbvyqaunqpp7wzmpenatra._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

macro persistence xlm

Link:

https://tria.ge/reports/210930-ss3nnaaae9/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Control Panel

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Drops file in Windows directory

Adds Run key to start application

Enumerates connected drives

Loads dropped DLL

Blocklisted process makes network request

Executes dropped EXE

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/36417eb2ecdb/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.88

Link:

https://yomi.yoroi.company/submissions/36417eb2ecdbb537b9679f959a8ab356e954f1a1ae200a360f7fed963c8d04e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	metamorfo_msi Create hunting rule
Author:	jeFF0Falltrades
Description:	This is a simple, albeit effective rule to detect most Metamorfo initial MSI payloads

Rule name:	suspicious_msi_file Create hunting rule
Author:	Johnk3r
Description:	Detects common strings, DLL and API in Banker_BR

Rule name:	win_unidentified_072_w0 Create hunting rule
Author:	jeFF0Falltrades
Description:	This is a simple, albeit effective rule to detect most Metamorfo initial MSI payloads