MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3701e89a871bcd41d4acd221aa855fad14f9fbafbc21da9695b5084951e561c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RaspberryRobin


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3701e89a871bcd41d4acd221aa855fad14f9fbafbc21da9695b5084951e561c7
SHA3-384 hash: fa89728620e1e8e34a4449f79eb9ac5f8601230a7559722381553ccbceb0456a65c5b42537acc18d99f69ddbd3d00356
SHA1 hash: 2da77c7d531ed6cc84c946b94b0892caa4a8e6a7
MD5 hash: bb1d1ccb1b6a37a19bb5cbbcb18ec382
humanhash: glucose-green-item-kitten
File name:keygen-step-2.cpl
Download: download sample
Signature RaspberryRobin
Create hunting rule
File size:1'875'968 bytes
First seen:2024-08-26 17:36:48 UTC
Last seen:2024-08-26 18:32:00 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 9d5323b4a1da3aca909765905da6172e (1 x RaspberryRobin)
ssdeep 49152:mRkHV0tF2wH2Z7ryv0kYHm3gnAXKiKqRMP:ikCF2a2Z6v0a3gnAX1Kqa
Threatray 1 similar samples on MalwareBazaar
TLSH T15B95BEDEE0DC912CEB2D46F904AC3FE68A6C6320E2596D37F65E10AA594454E33DC43E
TrID 51.4% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
15.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
14.0% (.EXE) Win32 Executable (generic) (4504/4/1)
6.3% (.EXE) OS/2 Executable (generic) (2029/13)
6.2% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter aachum
Tags:cpl KeygenGuru RaspberryRobin

Intelligence

File Origin
# of uploads :
2
# of downloads :
100
Origin country :
ES ES
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.11050.29645.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66ccbd40b2a4681a7296a9f6
Tags:
Fauppod
Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fauppod lolbin masquerade microsoft_visual_cc packed shell32
Link:
https://www.filescan.io/uploads/66ccbd3f8c6af95c2db6ee8d/reports/4cb264e4-b063-4ca1-834e-14736740e4e0/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/3701e89a871bcd41d4acd221aa855fad14f9fbafbc21da9695b5084951e561c7
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/debffc68-aea6-48bc-8891-d4db7bc377de
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3701e89a871bcd41d4acd221aa855fad14f9fbafbc21da9695b5084951e561c7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3701e89a871bcd41d4acd221aa855fad14f9fbafbc21da9695b5084951e561c7/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2024-08-26 17:37:05 UTC
File Type:
PE (Dll)
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g4a6rguhdpgudvfm2iq2vbk7vukpt65pxqq5vfuvwueesupfmhdq._file
Verdict:
malicious
Similar samples:
3701e89a871bcd41d4acd221aa855fad14f9fbafbc21da9695b5084951e561c7
RaspberryRobin
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/240826-v65raaxgmn/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
3701e89a871bcd41d4acd221aa855fad14f9fbafbc21da9695b5084951e561c7
MD5 hash:
bb1d1ccb1b6a37a19bb5cbbcb18ec382
SHA1 hash:
2da77c7d531ed6cc84c946b94b0892caa4a8e6a7
Link:
https://www.unpac.me/results/fd257338-72fa-4aea-9135-b39aad0d4d4a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/3701e89a871bcd41d4acd221aa855fad14f9fbafbc21da9695b5084951e561c7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe edbe03f74167f65d2c416d8dd7dd809ecbcc39b1dcdbd9fb8a7797503170e5db

RaspberryRobin

DLL dll 3701e89a871bcd41d4acd221aa855fad14f9fbafbc21da9695b5084951e561c7

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 edbe03f74167f65d2c416d8dd7dd809ecbcc39b1dcdbd9fb8a7797503170e5db
  
Dropped by
MD5 9f52f0ddebef7dae9a591cebf727d9ef

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
MULTIMEDIA_APICan Play MultimediaAVIFIL32.dll::AVIFileExit
MSVFW32.dll::DrawDibGetPalette
RAS_APIUses Remote AccessRASAPI32.dll::RasGetEapUserDataW
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW

Comments