MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37516ed4d9c3e3cce3cd810998fda81ef23453ef2777d246753e1ca2aa8f55ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37516ed4d9c3e3cce3cd810998fda81ef23453ef2777d246753e1ca2aa8f55ee
SHA3-384 hash: c5fa06d96df2a3683422c59ceb549ef1656468bef806328dbe759493a0f24f6e234894a294fad4e5de3b7fbc73433ca5
SHA1 hash: 23549746f5c1417940cda50c04831782e9d82b65
MD5 hash: f7921031f181d103b60e0443ab46e52a
humanhash: utah-lake-sad-johnny
File name:CourvixVPN.exe
Download: download sample
File size:1'632'256 bytes
First seen:2022-02-27 11:04:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 49152:z4OXpS9EpPFhCzjS/sSmbSl609ehw+W7SCqDnVQc:zpXpuEpthC/S/sSWSlwymN
Threatray 161 similar samples on MalwareBazaar
TLSH T1DE7533F365244163EB3D36FD41980F5609FA6BFE4C96EB4E4B58282C8761B97C42063B
File icon (PE):PE icon
dhash icon 0671697973a6ec11
Reporter Anonymous
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
288
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/245079/
Detection(s):
SecuriteInfo.com.MachineLearning.Anomalous.95.15003.13036.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a file
DNS request
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
netsh.exe obfuscated packed update.exe
Link:
https://www.filescan.io/uploads/621b5ae2b94fb38cb4199eba/reports/8ee73349-867e-45ba-ac9a-0da2c177099c/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/1856f9ee-d6e1-41f6-9b79-392ac858e4b8
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/946920
Signature
Moves itself to temp directory
Tries to detect virtualization through RDTSC time measurements
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37516ed4d9c3e3cce3cd810998fda81ef23453ef2777d246753e1ca2aa8f55ee/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-01-23 08:33:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
6 of 28 (21.43%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1647393d7971b61b15821198c9acb29501e0698e785d69d8d4de46b0c98952ec
24f1080061307e78c9630ca5e35ef1daddd224035163a72f6678098507fcd8b0
7228634bbebee87d96a088337f7b0e59645e84561d1e658bc67ccf0fed6d6b80
a29b298d47a77ebcdd68e8ca81538d15ef1f53f0ef4ee6041603ef68987bc26b
b0ac37aec0eef942e0ff9c35828584b8d887f951ec13afbd80cdc4ce23595ae4
b1c5e602c1646d6f3d05c37e301c7b808b21e3128fea2687821b1348f41a892d
b53db8cda884be522adeb2f293a41fa80fa2522b3c2eedb1ed20841c5a41d716
b9f8a72e66d7208d3dda09ed8a4d654466b46013251cb868d36c56cd521905a1
fddfa27a56eb44a653c6d5d7947d62415896a15da7cbd4cf8e7b72334e6f0833
+ 151 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/220227-m6vbjsddgl/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Link:
https://www.unpac.me/results/475ed3ba-f506-47e2-bfc0-8bee1b318198/
Parent samples :
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
69e2ae11e1b5cbe120bf02301191a1cf05e87fc09b09d63bd782abbf3615d05d
0b778873c94f6bc89a40294c0e85a38ab82509260cd2a2e8b73d00c5c90e8757
7ddfa6f44a60f4b894321f6977f8121cfb371c3c61ac872c58ba61fd5ee13deb
SH256 hash:
6ec6cb4a4e1995a6135f4e99de221e57988d99b18483a4d881aeacb5ea8ced85
MD5 hash:
1379059570352e678ee38902c2a6d65f
SHA1 hash:
031bbfa744314279f0bf9e4bbd42586b6d9ecfb6
Link:
https://www.unpac.me/results/475ed3ba-f506-47e2-bfc0-8bee1b318198/
SH256 hash:
37516ed4d9c3e3cce3cd810998fda81ef23453ef2777d246753e1ca2aa8f55ee
MD5 hash:
f7921031f181d103b60e0443ab46e52a
SHA1 hash:
23549746f5c1417940cda50c04831782e9d82b65
Link:
https://www.unpac.me/results/475ed3ba-f506-47e2-bfc0-8bee1b318198/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/37516ed4d9c3e3cce3cd810998fda81ef23453ef2777d246753e1ca2aa8f55ee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/245079/

Comments