MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mimic


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456
SHA3-384 hash: 1361b25b812f16a8d35eb1e3516772b7182b4e3ec193ff6b5ce94f280c5e3a1917c76276bab650bec576d347d8cdfdfb
SHA1 hash: b1929abb6f538c636bf4210a173678bde64614c7
MD5 hash: a6f124515524bab5cabd4e749df9770f
humanhash: louisiana-harry-two-jersey
File name:3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456
Download: download sample
Signature Mimic
Create hunting rule
File size:6'503'440 bytes
First seen:2024-10-17 18:04:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a1ff7dadf6595f429c981c2d30a8301d (1 x Mimic)
ssdeep 98304:vk5b0H4+DGmnxx8g8Noib+Ug1E4fKcHzLBsbGsLlyndn8S1ad3dWpELfxl6:vNHJx8Wib1gY+zuPLMdb143dWObv6
TLSH T1496633A294CA6E65F24D3CB24E321E17A550DCA0878761BF92EF004D651B2CD2BFE74D
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4504/4/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter JAMESWT_WT
Tags:cyberfear-com exe Mimic Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
472
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456
Verdict:
No threats detected
Analysis date:
2024-10-17 18:09:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/487723dd-61b8-475b-903d-00ca5aa5d73d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Siggen29.41253.21717.10655.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=671151d534f884d15c8c6c65
Tags:
Vmdetect Packed
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm lolbin microsoft_visual_cc packed packed ransomware shell32 themidawinlicense virus xpack
Link:
https://www.filescan.io/uploads/671151d2bc6470761600c40f/reports/f7c1466a-6a3c-43e9-9de4-753fc8830184/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456
Result
Verdict:
MALICIOUS
Malware family:
ChromePolish
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bddbecfd-747f-402c-b211-b1aea3f64633
Result
Threat name:
Babuk, Mimic, TrojanRansom
Create hunting rule
Detection:
malicious
Classification:
rans.troj.expl.evad.spre
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1536330
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an undocumented autostart registry key
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Self deletion via cmd or bat file
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Babuk Ransomware
Yara detected Mimic Ransomware
Yara detected TrojanRansom
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1536330 Sample: x5n4eaCdeO.exe Startdate: 17/10/2024 Architecture: WINDOWS Score: 100 85 Malicious sample detected (through community Yara rule) 2->85 87 Antivirus / Scanner detection for submitted sample 2->87 89 Multi AV Scanner detection for dropped file 2->89 91 8 other signatures 2->91 14 x5n4eaCdeO.exe 2 39 2->14         started        18 PIDAR.exe 5 2->18         started        20 PIDAR.exe 5 2->20         started        process3 file4 65 C:\Users\user\Desktopverything32.dll, PE32 14->65 dropped 67 C:\Users\user\Desktopverything.exe, PE32 14->67 dropped 69 C:\Users\user\Desktop\DC.exe, PE32 14->69 dropped 71 7 other files (5 malicious) 14->71 dropped 167 Query firmware table information (likely to detect VMs) 14->167 169 Creates an undocumented autostart registry key 14->169 171 Self deletion via cmd or bat file 14->171 22 PIDAR.exe 5 14->22         started        25 cmd.exe 1 14->25         started        173 Hides threads from debuggers 18->173 175 Tries to detect sandboxes / dynamic malware analysis system (registry check) 18->175 177 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->177 27 PIDAR.exe 5 18->27         started        signatures5 process6 signatures7 101 Antivirus detection for dropped file 22->101 103 Multi AV Scanner detection for dropped file 22->103 105 Query firmware table information (likely to detect VMs) 22->105 117 2 other signatures 22->117 29 PIDAR.exe 5 22->29         started        107 Uses ping.exe to sleep 25->107 109 Uses ping.exe to check the status of other devices and networks 25->109 32 fsutil.exe 1 25->32         started        35 PING.EXE 1 25->35         started        38 conhost.exe 25->38         started        111 Hides threads from debuggers 27->111 113 Tries to detect sandboxes / dynamic malware analysis system (registry check) 27->113 115 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 27->115 40 PIDAR.exe 5 27->40         started        process8 dnsIp9 151 Query firmware table information (likely to detect VMs) 29->151 153 Hides threads from debuggers 29->153 155 Tries to detect sandboxes / dynamic malware analysis system (registry check) 29->155 42 PIDAR.exe 5 29->42         started        63 C:\Users\user\Desktop\x5n4eaCdeO.exe, data 32->63 dropped 73 127.0.0.1 unknown unknown 35->73 75 127.0.0.2 unknown unknown 35->75 157 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 40->157 file10 signatures11 process12 signatures13 135 Query firmware table information (likely to detect VMs) 42->135 137 Hides threads from debuggers 42->137 139 Tries to detect sandboxes / dynamic malware analysis system (registry check) 42->139 141 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 42->141 45 PIDAR.exe 5 42->45         started        process14 signatures15 159 Query firmware table information (likely to detect VMs) 45->159 161 Hides threads from debuggers 45->161 163 Tries to detect sandboxes / dynamic malware analysis system (registry check) 45->163 165 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 45->165 48 PIDAR.exe 5 45->48         started        process16 signatures17 77 Query firmware table information (likely to detect VMs) 48->77 79 Hides threads from debuggers 48->79 81 Tries to detect sandboxes / dynamic malware analysis system (registry check) 48->81 83 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 48->83 51 PIDAR.exe 5 48->51         started        process18 signatures19 93 Query firmware table information (likely to detect VMs) 51->93 95 Hides threads from debuggers 51->95 97 Tries to detect sandboxes / dynamic malware analysis system (registry check) 51->97 99 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 51->99 54 PIDAR.exe 5 51->54         started        process20 signatures21 119 Query firmware table information (likely to detect VMs) 54->119 121 Hides threads from debuggers 54->121 123 Tries to detect sandboxes / dynamic malware analysis system (registry check) 54->123 125 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 54->125 57 PIDAR.exe 5 54->57         started        process22 signatures23 127 Query firmware table information (likely to detect VMs) 57->127 129 Hides threads from debuggers 57->129 131 Tries to detect sandboxes / dynamic malware analysis system (registry check) 57->131 133 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 57->133 60 PIDAR.exe 5 57->60         started        process24 signatures25 143 Query firmware table information (likely to detect VMs) 60->143 145 Hides threads from debuggers 60->145 147 Tries to detect sandboxes / dynamic malware analysis system (registry check) 60->147 149 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 60->149
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456/
Threat name:
Win32.Ransomware.CryptoLocker
Create hunting rule
Status:
Malicious
First seen:
2024-09-14 14:06:38 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hifllqdfuij6y5yxnvncs4qnlnzfjkewew3mvjjva7eek3yl4rla._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery themida
Link:
https://tria.ge/reports/241017-wn623a1cmk/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Themida packer
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/54484d57-389a-4129-8a95-f5a5ce1dacc1
Unpacked files
SH256 hash:
dcb842f5e0da9d486cad34d4b809dcaadf9ec4d6991fdb22bdc9aea66489ad1a
MD5 hash:
c02a029c978f13b753c6b578b1588c75
SHA1 hash:
e125d59451e7f467bfd329a00a506decbcd91d83
Link:
https://www.unpac.me/results/3fd8b495-64c9-41ac-ae56-452538ccf848/
SH256 hash:
7144db3a2d73a1927c4eec18e890e273eb76f146c20e8ec553668508aff01029
MD5 hash:
9ed7cf457034e76d2ac94fb066a23dfd
SHA1 hash:
e18a04a06b328908604765fb519888aad42ff490
Detections:
AutoIT_Compiled
Create hunting rule
INDICATOR_TOOL_PET_DefenderControl
Create hunting rule
Link:
https://www.unpac.me/results/3fd8b495-64c9-41ac-ae56-452538ccf848/
Parent samples :
3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456
10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86
SH256 hash:
17761109c6028abc1bb183d6b200daab3c8eca241797fe562ca25a020e38c354
MD5 hash:
50b928a80a1c984012a4461433b15ccf
SHA1 hash:
61aaba67299be9a060a2a8dc30ea26b63b7573bc
Link:
https://www.unpac.me/results/3fd8b495-64c9-41ac-ae56-452538ccf848/
SH256 hash:
2aae82d3f537383f5b6183c7ea4b86867ac4e434b4274efdf9a019fdffc99a15
MD5 hash:
f686fbdabcaeb077f8e068df6ea789e3
SHA1 hash:
71d14f1854049de246f566a6df69cf4f0f57ffac
Link:
https://www.unpac.me/results/3fd8b495-64c9-41ac-ae56-452538ccf848/
SH256 hash:
3e5118d54e5ceff61341baee13839f3cb79ec3533cb99591698f551273cd1f85
MD5 hash:
149771b42c70e468397aedf1ec56824e
SHA1 hash:
65a1eb47b02030223964d862dc992499570d97c7
Link:
https://www.unpac.me/results/3fd8b495-64c9-41ac-ae56-452538ccf848/
SH256 hash:
1b5bb3904fda3faa76d475f503b810993628c3e64457844525968935daf9538f
MD5 hash:
d0c0254f0bfd036ec7f73ad781ddac64
SHA1 hash:
129af39baf719633481f2023e4d3e3897fb0a2f6
Detections:
Detect_Mimic_Ransomware
Create hunting rule
INDICATOR_SUSPICIOUS_ClearWinLogs
Create hunting rule
INDICATOR_EXE_Packed_Themida
Create hunting rule
INDICATOR_SUSPICIOUS_GENRansomware
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
INDICATOR_SUSPICIOUS_USNDeleteJournal
Create hunting rule
Link:
https://www.unpac.me/results/3fd8b495-64c9-41ac-ae56-452538ccf848/
SH256 hash:
3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456
MD5 hash:
a6f124515524bab5cabd4e749df9770f
SHA1 hash:
b1929abb6f538c636bf4210a173678bde64614c7
Link:
https://www.unpac.me/results/3fd8b495-64c9-41ac-ae56-452538ccf848/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_TRUST_INFORequires Elevated Execution (uiAccess:None)high
Reviews
IDCapabilitiesEvidence
NET_SHARE_APICan access Network ShareNETAPI32.dll::NetShareEnum
WIN_BCRYPT_APICan Encrypt Filesbcrypt.dll::BCryptGenRandom
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetOpenEnumW

Comments