MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a7e260aec294903b08eb34f2b9a985bd38bd66a409bbb7e58bd8f4e5c3a7806. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a7e260aec294903b08eb34f2b9a985bd38bd66a409bbb7e58bd8f4e5c3a7806
SHA3-384 hash: ab3f3b853e87ea3a399af689ba3c59b75a04406e1f02382932855106e544faa5282f5dddfb4fc2dff17e5874b9fd8942
SHA1 hash: 0b30b6136ee2ded66b07f7e33023d00699c074a9
MD5 hash: 83754fa016cb31ea372d1b3f6c34708d
humanhash: uniform-pizza-wyoming-eighteen
File name:83754fa016cb31ea372d1b3f6c34708d
Download: download sample
File size:4'011'008 bytes
First seen:2021-10-28 10:17:23 UTC
Last seen:2021-10-28 12:52:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6ed4f5f04d62b18d96b26d6db7c18840 (255 x SalatStealer, 78 x BitRAT, 42 x RedLineStealer)
ssdeep 98304:707adU1jSnaEeCa7TsW74NuCqO8W7W0O+:MadUZEeC2T574NK/Wq4
Threatray 466 similar samples on MalwareBazaar
TLSH T1E9063340AD3A75E4F253467A04EABAD4C969A38F26301DD13EBCFBC055352E29C1E5CB
Reporter zbetcheckin
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://duiwqyue.digital/bghost.exe
Verdict:
No threats detected
Analysis date:
2021-10-25 22:44:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c6a738e1-f8c9-49b7-8879-39acc98af4f1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/200885/
Detection(s):
SecuriteInfo.com.Trojan.Generic.31068367.24867.22851.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending an HTTP POST request
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/617a78e09a5a1e91c5d9913c/reports/0189d462-6b0e-45a3-b864-f765769558d4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d9a893f4-21ec-490f-89bc-2b7d2572472b
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/878558
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a7e260aec294903b08eb34f2b9a985bd38bd66a409bbb7e58bd8f4e5c3a7806/
Threat name:
Win64.Dropper.Sysn
Create hunting rule
Status:
Malicious
First seen:
2021-10-25 16:40:46 UTC
AV detection:
20 of 44 (45.45%)
Threat level:
  3/5
Verdict:
malicious
Similar samples:
32eef267a1192a9a739ccaaae0266bc66707bb64768a764541ecb039a50cba67
417c9fa1bbc670233243b3fbbf9d10c5a5e60a900b5e861b969ce7705ad317bf
b367760b3de8efbaceb0c71acb3fe5763e164e89ec88390adb5b5a2cc85467a9
ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0
d38f78f931898d8cd152dc2e10900e784392c0a8e22e9d45f6f65827c6d17782
d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455
d77ad6187d7862303d1fba3b73797fea0b4b4821ac7fbc6c006db3b27b9fefaa
dda918f09ec1d46c0ece122efce15ef8985857e0c9b372b9a67466f7700c6c70
e463d24b09ee120b0d0b6230d24f4337a73e312a4ac7fb9a3b434ec0a805db00
f83ff41855709553f7f425aebd23420d3b2dd5e1e04cc7c619ba77920137ded4
+ 456 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence upx
Link:
https://tria.ge/reports/211028-mbzb1scah4/
Behaviour
GoLang User-Agent
Adds Run key to start application
Unpacked files
SH256 hash:
3a7e260aec294903b08eb34f2b9a985bd38bd66a409bbb7e58bd8f4e5c3a7806
MD5 hash:
83754fa016cb31ea372d1b3f6c34708d
SHA1 hash:
0b30b6136ee2ded66b07f7e33023d00699c074a9
Link:
https://www.unpac.me/results/d673e5ff-b2cd-4f44-999f-171d892b69a2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3a7e260aec294903b08eb34f2b9a985bd38bd66a409bbb7e58bd8f4e5c3a7806

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:GoBinTest
Create hunting rule
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 3a7e260aec294903b08eb34f2b9a985bd38bd66a409bbb7e58bd8f4e5c3a7806

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1722801/
Cape
Cape
https://www.capesandbox.com/analysis/200885/

Comments


Avatar
zbet commented on 2021-10-28 10:17:24 UTC

url : hxxps://duiwqyue.digital/bghost.exe