MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3aac811cea31d85addf591a79e59441373476238716c04e5cc20d1d7239f18cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3aac811cea31d85addf591a79e59441373476238716c04e5cc20d1d7239f18cc
SHA3-384 hash: 3245e50c3ec9dc9bf8f7215814439c47fa6cda2d35419d72c26efaedc68b9572553586ba472419ab32e2996099e8a665
SHA1 hash: cacf75237dd0190ddd4f80583fde6d3384c66300
MD5 hash: 7158d38ca5141701d75ca000a7501fd9
humanhash: gee-missouri-montana-mango
File name:7158d38ca5141701d75ca000a7501fd9.exe
Download: download sample
File size:4'509'696 bytes
First seen:2023-03-23 09:43:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9aebf3da4677af9275c461261e5abde3 (25 x YTStealer, 12 x CobaltStrike, 11 x Hive)
ssdeep 98304:OBF6+ogwEMfNV1HtUsmxSUF8CQQJk52nQiao5rig:UTYEiV1mLxSUVQanraOm
TLSH T1362633AF1D92F14DED20BA34A3C622F8217561399300336B781C1DADB76ED1794958EF
TrID 63.5% (.EXE) UPX compressed Win64 Executable (70117/5/12)
24.5% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.8% (.ICL) Windows Icons Library (generic) (2059/9)
1.8% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
238
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7158d38ca5141701d75ca000a7501fd9.exe
Verdict:
Malicious activity
Analysis date:
2023-03-23 09:47:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b257c0dd-7c6b-43db-8edf-c35e8bb0e411

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/376810/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Reading critical registry keys
Running batch commands
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug packed
Link:
https://www.filescan.io/uploads/641c1f653b01ade53e70c458/reports/4c6823e6-165c-4889-aa79-7c60f9b53203/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/3aac811cea31d85addf591a79e59441373476238716c04e5cc20d1d7239f18cc
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/adb1b825-bec4-40aa-95d3-f089227e48d6
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1200242
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 833150 Sample: vilr6RWUOg.exe Startdate: 23/03/2023 Architecture: WINDOWS Score: 60 16 Antivirus / Scanner detection for submitted sample 2->16 18 Multi AV Scanner detection for submitted file 2->18 7 vilr6RWUOg.exe 2->7         started        process3 signatures4 20 Tries to harvest and steal browser information (history, passwords, etc) 7->20 10 cmd.exe 1 7->10         started        process5 process6 12 conhost.exe 10->12         started        14 choice.exe 1 10->14         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3aac811cea31d85addf591a79e59441373476238716c04e5cc20d1d7239f18cc/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-03-23 09:05:00 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
15 of 37 (40.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hkwichhkghmfvxpvsgtz4wkecnzuoyryofwajzomedi5oi47ddga._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer upx
Link:
https://tria.ge/reports/230323-lqg6lseg69/
Behaviour
Suspicious use of WriteProcessMemory
Reads user/profile data of web browsers
UPX packed file
Unpacked files
SH256 hash:
55cac5378778899f887d741eff6467fbd79f2ff5ff0dc094a4eb926b84ef5ae5
MD5 hash:
200ba25a579a0270ca062f8f784e05ee
SHA1 hash:
b1492f088644e769a56cb6a73dbd99fb1cde0ad3
Link:
https://www.unpac.me/results/ad42d43a-7e83-4b02-b128-6c5793cfe39c/
SH256 hash:
3aac811cea31d85addf591a79e59441373476238716c04e5cc20d1d7239f18cc
MD5 hash:
7158d38ca5141701d75ca000a7501fd9
SHA1 hash:
cacf75237dd0190ddd4f80583fde6d3384c66300
Link:
https://www.unpac.me/results/ad42d43a-7e83-4b02-b128-6c5793cfe39c/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 3aac811cea31d85addf591a79e59441373476238716c04e5cc20d1d7239f18cc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2563428/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/376810/

Comments