MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3984f829f5857c513de4b0c89a2e4ccc31e05f19100d575714471d0657b5734d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ousaban


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3984f829f5857c513de4b0c89a2e4ccc31e05f19100d575714471d0657b5734d
SHA3-384 hash: f00deb52fa037d4291c4b34c373d60b338691101c5196e34f894761c912f4a4c6b36c77470b5224e896e7f3b92b155e0
SHA1 hash: 102b0598495e8e2043fb029379c5c3e2ca92cca8
MD5 hash: c9baaec85227b2f73a65a8bfb72b128d
humanhash: delaware-muppet-mike-mountain
File name:Protocolo_juridico - WQTKPUTULW暝.msi
Download: download sample
Signature Ousaban
Create hunting rule
File size:23'965'696 bytes
First seen:2022-12-15 14:34:17 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 393216:twbQDjjLy1OPJ0kkxlZ6k5+FqxoDZEVwOvG/ji1/fualsZ6vGPdPT:t/q1OPJ0kkf8k5+F7l9OvG0fFlsQa
Threatray 17 similar samples on MalwareBazaar
TLSH T15F37D320937779D8EA2762BFF4AC5FC48010F5F1A118EA7B73783FA58AD054661B6903
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter johnk3r
Tags:banker msi ousaban

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
BR BR
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
shell32.dll
Link:
https://www.filescan.io/uploads/639b3098af37e85897649f4e/reports/796871ca-64bb-4e9b-b848-4ca6f1e24d28/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/3984f829f5857c513de4b0c89a2e4ccc31e05f19100d575714471d0657b5734d
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1135069
Signature
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-12-14 15:33:29 UTC
File Type:
Binary (Archive)
Extracted files:
80
AV detection:
5 of 39 (12.82%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hgcpqkpvqv6fcppewdejulsmzqy6axyzcagvovyui4oqmv5vongq._file
Verdict:
unknown
Similar samples:
0cf728a105d41d01c1895e126253343b63c30b720700b195c54bec21e109fbe1
Ousaban
18e57acc198a3afad96f6fff17a0cc538da02afcba38036dda6cf1b8902efd2b
Ousaban
27b5e52c0c575a9d1a1e460ee54fc4f411fd5783b886854d332253c4ff80c51e
Ousaban
4296080a2384f70638c544c1a4d598035cb895e7346080960df2413510e0c04a
Ousaban
4f6cb888a4dfade727490683feaee96679d7044f0181799c18a8c7060cb8dab3
Ousaban
7321a205de31cb4c93f10a090316502922d9083dfc076c93903377f36ada3aca
Ousaban
ce41f7c712e0113700f0f3653868200af041f3e170f45dacc6d6e3542ab91062
Ousaban
ffb318a5fd569396377f80259fb3b2ff02ef492efa1922ccbdd1bcdf1f43c162
Ousaban
+ 7 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/221215-rxz8nace86/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Enumerates connected drives
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/3984f829f5857c513de4b0c89a2e4ccc31e05f19100d575714471d0657b5734d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link

Comments