MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b7b44dd7b962d287957a7f912218d56b224e743cab832db0114e69fb329387a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stop

Vendor detections: 14

Intelligence 14 IOCs 1 YARA 24 File information Comments

SHA256 hash:	3b7b44dd7b962d287957a7f912218d56b224e743cab832db0114e69fb329387a
SHA3-384 hash:	aff47a87bdb33bab41607d6c3eef77132c630eb04e29fe2cd5979d58dbda350785c584688735b43e46962c61bbe622be
SHA1 hash:	c62e55652bb21ff68d8349d1cbce5f24638ab124
MD5 hash:	a125d966fb6c763185241ecc62d29c14
humanhash:	delaware-neptune-oven-purple
File name:	a125d966fb6c763185241ecc62d29c14.exe
Download:	download sample
Signature	Stop Create hunting rule
File size:	229'376 bytes
First seen:	2022-04-17 11:15:54 UTC
Last seen:	2022-04-17 11:30:03 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	da61341d624df6b164be48768fc6f0f0 (1 x Stop)
ssdeep	6144:9W0tfqXFzmnidHo7hs/ITotn9yNrfuEyjFeCvMDP4:9PfAtmniBoFs/VnEuEyJhKA
Threatray	5'154 similar samples on MalwareBazaar
TLSH	T179244B30B150F43BE8A20535B4ED97F6592C6A305F6589EBB7C44F2A0E752D29131F2B
TrID	40.3% (.EXE) Win64 Executable (generic) (10523/12/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4505/5/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	00cce8f0d0e871b2 (3 x Stop, 1 x Smoke Loader, 1 x TeamBot)
Reporter	abuse_ch
Tags:	exe Stop

abuse_ch

Stop C2:
193.106.191.204:23196

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
193.106.191.204:23196	https://threatfox.abuse.ch/ioc/520635/

Intelligence

File Origin

# of uploads :

# of downloads :

294

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

socelars

ID:

File name:

Setup.exe

Verdict:

Malicious activity

Analysis date:

2022-04-10 15:58:27 UTC

Tags:

evasion trojan socelars stealer loader rat redline

Link:

https://app.any.run/tasks/8aaaadd2-2997-455b-933f-d00a59a8981d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

DLInjector06

Link:

https://www.capesandbox.com/analysis/264163/

Detection(s):

SecuriteInfo.com.Variant.Zusy.420585.11578.8329.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Creating a file

Reading critical registry keys

Сreating synchronization primitives

Creating a process from a recently created file

Creating a process with a hidden window

Creating a file in the %temp% directory

Creating a window

Searching for the window

Launching a process

Creating a file in the Program Files subdirectories

Searching for synchronization primitives

Searching for analyzing tools

Running batch commands

Blocking the Windows Defender launch

Unauthorized injection to a recently created process

Sending an HTTP GET request to an infection source

Sending an HTTP POST request to an infection source

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/14064/overview

Behaviour

MalwareBazaar

CallSleep

MeasuringTime

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware shell32.dll

Link:

https://www.filescan.io/uploads/625bf6f6ffe27d5119f28c7c/reports/43e56565-a233-4696-82ea-a55dc5af3bf3/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Bsymem

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/68b32c79-9f09-4bf4-bfb7-258d50a4edb2

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/977828

Signature

Antivirus detection for dropped file

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Detected unpacking (overwrites its own PE header)

Disable Windows Defender real time protection (registry)

Downloads files with wrong headers with respect to MIME Content-Type

Found C&C like URL pattern

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3b7b44dd7b962d287957a7f912218d56b224e743cab832db0114e69fb329387a/

Threat name:

Win32.Backdoor.Zapchast

Status:

Malicious

First seen:

2022-04-10 21:28:24 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 42 (59.52%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hn5ujxl3sywsq6kxu74reimnk2zcjz2dzk4dfwybcttj7mzjhb5a._file

Verdict:

malicious

Stop

3d41425daa1e1844be0539723042dc532a640e5ba9ef9cdd09e22176c960098b

Stop

849beb1413d9750e1bad8a3758dc87053d47fe5cba1528723414c918625e6d27

Stop

a5453a830d01639ad537320c94e68565341328c872a8f2d3456221a0bec6f3e9

Stop

eeb0c6a760a7c9d17c02dbacf4f4715917caf3d111209ce29b67b366dc8b9dd9

Stop

+ 5'144 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

discovery evasion spyware stealer suricata trojan

Link:

https://tria.ge/reports/220417-nc45bsedam/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Looks up external IP address via web service

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Defender Real-time Protection settings

suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

Unpacked files

SH256 hash:

3b7b44dd7b962d287957a7f912218d56b224e743cab832db0114e69fb329387a

MD5 hash:

a125d966fb6c763185241ecc62d29c14

SHA1 hash:

c62e55652bb21ff68d8349d1cbce5f24638ab124

Link:

https://www.unpac.me/results/6496f915-b6d5-4038-af2e-12ff4ca80d95/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3b7b44dd7b962d287957a7f912218d56b224e743cab832db0114e69fb329387a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	adonunix2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	AD on UNIX

Rule name:	BAZT_B5_NOCEXInvalidStream Create hunting rule

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing bas64 encoded gzip files

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifcats referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks

Rule name:	INDICATOR_SUSPICIOUS_References_SecTools Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many IR and analysis tools

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MALWARE_Win_STOP Create hunting rule
Author:	ditekSHen
Description:	Detects STOP ransomware

Rule name:	MALWARE_Win_Vidar Create hunting rule
Author:	ditekSHen
Description:	Detects Vidar / ArkeiStealer

Rule name:	NETDIC208_NOCEX Create hunting rule

Rule name:	NETDIC208_NOCEX_NOREACTOR Create hunting rule

Rule name:	NETDIC_208 Create hunting rule

Rule name:	Redline_Stealer_Monitor Create hunting rule
Description:	Detects RedLine Stealer Variants

Rule name:	SUSP_XORed_URL_in_EXE Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	Vidar Create hunting rule
Author:	kevoreilly
Description:	Vidar Payload

Rule name:	win_stop_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.stop.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/264163/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample