MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3aea338fbee5f3e5eba06e17fef4c086bb5c5fb25294ac592e39d673165ddcac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3aea338fbee5f3e5eba06e17fef4c086bb5c5fb25294ac592e39d673165ddcac
SHA3-384 hash:	f61a058dec70143dafa3e00df6fbc10d0588ec5f19923e0943fde50ddf705f23b256220b34d07b9f161703f5fa37e735
SHA1 hash:	db02ff79bfde4f227cdd0e5f3474022c94e03755
MD5 hash:	de78b86ce2c8f6e5f88b9792a3d8df0c
humanhash:	carolina-low-echo-michigan
File name:	SecuriteInfo.com.Trojan.Uztuby.4.28297.11657
Download:	download sample
File size:	1'586'829 bytes
First seen:	2023-06-29 10:29:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	91e96141ed5dbe3bc541c8aad7ff3c38 (22 x CryptOne, 7 x njrat, 5 x DCRat)
ssdeep	24576:O208/RKHuEBY0gNchXOVmFfL6VsPYVqu3qQ8oLfpOh9pVrBgdG2l:908/RYOAOVaLisPrs8ozAh3hadDl
Threatray	126 similar samples on MalwareBazaar
TLSH	T1DE752221BBC084B2D56614311BE19732EB7C7C206F398ACB67841F2E9A785D19E39773
TrID	91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) 0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

284

Origin country :

FR

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

SecuriteInfo.com.Trojan.Uztuby.4.28297.11657

Verdict:

Suspicious activity

Analysis date:

2023-06-29 10:29:49 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/79cc1f11-c26e-426a-a49b-7e9f228d6188

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/403726/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Uztuby.4.28297.11657.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Launching a process

Sending a custom TCP request

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/94113/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

greyware lolbin overlay packed replace setupapi shdocvw shell32

Link:

https://www.filescan.io/uploads/649d5d2b10925f175affa09d/reports/d0ccc7da-7bb2-49b4-8751-fad1bc652fd5/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/3aea338fbee5f3e5eba06e17fef4c086bb5c5fb25294ac592e39d673165ddcac

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/75603f91-9b8c-4a40-a289-cc54fcaa6a40

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1263175

Signature

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3aea338fbee5f3e5eba06e17fef4c086bb5c5fb25294ac592e39d673165ddcac/

ReversingLabs TitaniumCloud Win32.Trojan.InjectorX

Threat name:

Win32.Trojan.InjectorX

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-29 09:57:15 UTC

File Type:

PE (Exe)

Extracted files:

18

AV detection:

17 of 24 (70.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hlvdhd564xz6l25anyl755gaq25vyx5skkkkywjohhlhgfs53swa._file

Threatray malicious

Verdict:

malicious

Similar samples:

09ae4390509ead8648638aa57cdf27e60e52635ec1719b3a061a7494d22007e2

1117693668d29e59a35caa9a21dd9f86a65107688413745051d4a94612ac7e9a

2646dd01581c1813f0478a25051ca4edac5e5c4fedcbd1ac0b4ca758426ec52d

35bcfd69dcfa8a03e82c1141d1138e26a2779527ec631d6d5c2f66a217548e05

3c4f456e84a4b82254480d17bd6db4c0a9ae6259e085b362b10183a82956d1ba

6daea442fe810be3520918e0df1f028c93d8505d7637b9791b1e710eb619e52e

9eabc737fcd4b9e3ee124a01cc30943e31d92a64e177be4e096d42b85359fe17

c4d39c82567f2122bc145a4bb52d195441cc695f974a81c2ae20e61c50229b32

e0cbce8d4adc0ea5992c6d0acf0844ebc7efadc8e4a3b52cf7d7f9a1aadc30f0

+ 116 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230629-mjst7sde8y/

Behaviour

Modifies registry class

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

UnpacMe

Unpacked files

SH256 hash:

3aea338fbee5f3e5eba06e17fef4c086bb5c5fb25294ac592e39d673165ddcac

MD5 hash:

de78b86ce2c8f6e5f88b9792a3d8df0c

SHA1 hash:

db02ff79bfde4f227cdd0e5f3474022c94e03755

Link:

https://www.unpac.me/results/1856f677-7a6e-46b6-99fc-406b919a6a93/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3aea338fbee5f3e5eba06e17fef4c086bb5c5fb25294ac592e39d673165ddcac

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 3aea338fbee5f3e5eba06e17fef4c086bb5c5fb25294ac592e39d673165ddcac

(this sample)

Cape

https://www.capesandbox.com/analysis/403726/

  

URLhaus

https://urlhaus.abuse.ch/url/2673593/

  

Delivery method

Distributed via web download