MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3aae50b1fdf4a372282b817998e883b2af9c204c008597e61579a4e56037b7ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	3aae50b1fdf4a372282b817998e883b2af9c204c008597e61579a4e56037b7ef
SHA3-384 hash:	a31c14a404d9de04d3eb912aef84269c55850d3ba29040d5065d59a9538d74e437df4e9437b67e9381cd1124523024a8
SHA1 hash:	9c3939e277b46c5af5590ad8d60562563e72f482
MD5 hash:	b794d9e78de84a06594fa2cc312fae7d
humanhash:	pasta-robert-papa-carpet
File name:	InfectSocks64_SQL_AntiVirus.vmp.dll
Download:	download sample
File size:	5'688'832 bytes
First seen:	2024-12-07 14:55:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	254272a8b1cac639347fec9bffcfa832
ssdeep	98304:bChUExZzhAR+wMCjqOmZ8TPhN0Q/H3xf9P/GaQ8BbxYNZ46hAEBmp5hy6p:YhAR+wMCjqOFz0Qv3fHGaF7YXjf
TLSH	T13D4622FDA2883358C41A8C344933ED46F1F5912E06FC956A7ACBBA807FAB854D523F45
TrID	44.4% (.EXE) Win64 Executable (generic) (10522/11/4) 21.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.6% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Gi7w0rm
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

442

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

InfectSocks64_SQL_AntiVirus.vmp.dll

Verdict:

No threats detected

Analysis date:

2024-12-07 15:08:58 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/da4ee60a-54cc-4c18-ab96-62aa2992de6f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.W64.Shadowforce.A.17052.11663.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67546208f992b2929a747174

Tags:

vmprotect virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for synchronization primitives

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

masquerade packed packed packed packer_detected vmprotect

Link:

https://www.filescan.io/uploads/675462031d55f117bfabb061/reports/03f3b417-7328-437e-bab2-34ac0f0beb5f/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/3aae50b1fdf4a372282b817998e883b2af9c204c008597e61579a4e56037b7ef

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/451dd194-6386-4682-9d4e-85e4d61d2905

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/3aae50b1fdf4a372282b817998e883b2af9c204c008597e61579a4e56037b7ef

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3aae50b1fdf4a372282b817998e883b2af9c204c008597e61579a4e56037b7ef/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hkxfbmp56srxekblqf4zr2edwkxzyicmacczpzqvpgsokybxw7xq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

vmprotect

Link:

https://tria.ge/reports/241207-sa1fks1khk/

Behaviour

Suspicious behavior: EnumeratesProcesses

VMProtect packed file

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1e75b838-0e41-4a80-b697-168f91e01ed1

Unpacked files

SH256 hash:

3aae50b1fdf4a372282b817998e883b2af9c204c008597e61579a4e56037b7ef

MD5 hash:

b794d9e78de84a06594fa2cc312fae7d

SHA1 hash:

9c3939e277b46c5af5590ad8d60562563e72f482

Link:

https://www.unpac.me/results/864bda84-678f-43d7-9929-d97433ecbaba/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3aae50b1fdf4a372282b817998e883b2af9c204c008597e61579a4e56037b7ef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_VMProtect Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with VMProtect.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 3aae50b1fdf4a372282b817998e883b2af9c204c008597e61579a4e56037b7ef

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3335173/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::LoadLibraryA
WIN_SVC_API	Can Manipulate Windows Services	ADVAPI32.dll::OpenServiceA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample