MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 375167eed0422ee98d7d5095efc35058daa0055884eb19960a16cf78015bb72d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 375167eed0422ee98d7d5095efc35058daa0055884eb19960a16cf78015bb72d
SHA3-384 hash: cf33ac0b61c48e3b386966a7956dd46f0c971d2fa2e76546f8f45c3bc844db8f7cf64c994909d696cb95d964260dd2f5
SHA1 hash: 445cadc5b1a180eddb08965440da728b1249f57d
MD5 hash: ca248723a600832af2f499836bf0f717
humanhash: robert-bakerloo-sink-johnny
File name:StellarImpact.zip
Download: download sample
File size:10'846'561 bytes
First seen:2022-11-18 06:32:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 196608:zIK0tZw2Br9yR22rUlF9P+qT3fC80FjyWutnrEy407TYXb:MKUVtARclFh+qzf6edhdEb
TLSH T19BB633579B920F81CD48A17794EA0F173659A36B081BFBCF2734F7A2BF715E98428412
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter iamdeadlyz
Tags:45-15-156-22 AuroraStealer exe FakeImpulseGame file-pumped pw-StellarImpactBeta StellarImpact zip


Avatar
Iamdeadlyz
From stellarimpact.io (impersonation of impulse.game | Twitter: @impulse_imp - 1447500345169563651)
Contains c72d781eec5d8c5ced29bd8d88f20aaf7ed962fe30f467d1378fb6c19e2a01ad
Stealer C&C: 45.15.156.22:8081

Intelligence

File Origin
# of uploads :
1
# of downloads :
242
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Launcher.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:784'439'296 bytes
SHA256 hash: c72d781eec5d8c5ced29bd8d88f20aaf7ed962fe30f467d1378fb6c19e2a01ad
MD5 hash: 22eace74f9c9efec81e0e4fa2600ed67
De-pumped file size:10'420'224 bytes (Vs. original size of 784'439'296 bytes)
De-pumped SHA256 hash: 77cda0e40715ba31b558029eb58ca2684a265d684d23aa6993ce1faee2534842
De-pumped MD5 hash: fa9a7e15af8b99dfd12edc96f5234f17
MIME type:application/x-dosexec
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/375167eed0422ee98d7d5095efc35058daa0055884eb19960a16cf78015bb72d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/375167eed0422ee98d7d5095efc35058daa0055884eb19960a16cf78015bb72d/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-11-18 06:35:28 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
3 of 40 (7.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g5iwp3wqiixotdl5kck67q2qldnkabkyqtvrtfqkc3hxqak3w4wq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

f088d45c62fe01b5c0b95248e651e3f2130bf615d02b33c97c16b6bbf8885238

zip 375167eed0422ee98d7d5095efc35058daa0055884eb19960a16cf78015bb72d

(this sample)

c72d781eec5d8c5ced29bd8d88f20aaf7ed962fe30f467d1378fb6c19e2a01ad

  
Dropped by
SHA256 f088d45c62fe01b5c0b95248e651e3f2130bf615d02b33c97c16b6bbf8885238
  
Dropping
SHA256 c72d781eec5d8c5ced29bd8d88f20aaf7ed962fe30f467d1378fb6c19e2a01ad
  
Dropping
SHA256 77cda0e40715ba31b558029eb58ca2684a265d684d23aa6993ce1faee2534842
  
Delivery method
Distributed via web download

Comments