MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ce7a091f24c19dd1a0875c60f9e97ee017435614198c62ca97220658723b785. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ce7a091f24c19dd1a0875c60f9e97ee017435614198c62ca97220658723b785
SHA3-384 hash: d68a2630922599bd3b459eb5e0c382772de6be69c03eff08da139fa143badd201f0a3a26ea77af975953848c92108cef
SHA1 hash: 5d80a3734f62abe6e248b2baad1a24eea19492a8
MD5 hash: 8b51a1e424e33f99c89e14538ab79ad3
humanhash: mockingbird-floor-batman-arizona
File name:出活跃户资料及聊天记录.com
Download: download sample
File size:985'168 bytes
First seen:2021-05-06 16:18:46 UTC
Last seen:2021-05-06 17:04:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash dac67ad15d498d52b875fafdd7113e11
ssdeep 12288:mULKPViLB87+nDS1hS0/ZxcJZYNyfI9vN+Q001i4zSqCUlRlhpNjRNFxKBz:mULKPDVNf9vN+Q001i4fpNjRPY
Threatray 62 similar samples on MalwareBazaar
TLSH CC25BF72BC41C0B3D5F210B689B9DDB12DBC5D314B1A82C742D03BB9AC364D27A7D99A
Reporter LittleRedBean2
Tags:com Telegram

Intelligence

File Origin
# of uploads :
2
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/151762/
Detection(s):
SecuriteInfo.com.Variant.Razy.865035.25177.30654.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Enabling the 'hidden' option for analyzed file
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Creating a file
Sending a UDP request
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Deleting a recently created file
Launching a process
Launching a service
Creating a window
Moving a recently created file
Running batch commands
Connection attempt
Enabling autorun with the shell\open\command registry branches
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/714360
Signature
Detected potential unwanted application
Multi AV Scanner detection for submitted file
Sigma detected: Execution from Suspicious Folder
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ce7a091f24c19dd1a0875c60f9e97ee017435614198c62ca97220658723b785/
Threat name:
Win32.PUA.Wacapew
Create hunting rule
Status:
Malicious
First seen:
2021-05-06 16:19:08 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  1/5
Verdict:
unknown
Similar samples:
02965941d39eef787b6d2483095f7c5c6eec84a2a97ce4e85eee9e0e610506e2
248c72c5eb7823243a820b9935e49534d8a94b91a6528afd8db98c9e8f56fbc0
389ddb82e254c476a6e3e2534182314d4702ce525371c2bcd5da6ef19d4851fb
43919cb86c587b0587b051f513b236247e4fd95cba88a8198e30c4603082cad8
979405efabab43a36e009a0bd005b01d4a4faf9113d14e3fc78865eb461bbc61
a578e71d04eae80004ab431497c95fb9779a95dc7f0c60996c24c1cb7139745d
a66d1021e54269963e9a54892869d569ffa1c74d9fb1b67f023ea5fdfd90c1a6
c96fb748304f35220cae69a622318ee3e425802dea7387549af4add7ba449b7e
ea45f9b3dd2e613bb9cb0659dcf6d66ca092738fc510e37226bb99542ad685c8
eb6478f051ae5b16921ed95f6a2f761512c79787ac2b54f0d00742ad526c34b8
+ 52 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion
Link:
https://tria.ge/reports/210506-e61tc3ezm6/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Looks for VirtualBox Guest Additions in registry
Unpacked files
SH256 hash:
3ce7a091f24c19dd1a0875c60f9e97ee017435614198c62ca97220658723b785
MD5 hash:
8b51a1e424e33f99c89e14538ab79ad3
SHA1 hash:
5d80a3734f62abe6e248b2baad1a24eea19492a8
Link:
https://www.unpac.me/results/4ba2d324-6f8b-4c98-b5d9-f8ef7c36e427/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ce7a091f24c19dd1a0875c60f9e97ee017435614198c62ca97220658723b785

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_01ea62e443cb2250c870ff6bb13ba98e
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/151762/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-06 17:11:43 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.025] Anti-Behavioral Analysis::Software Breakpoints
1) [B0009] Anti-Behavioral Analysis::Virtual Machine Detection
2) [B0012.001] Anti-Static Analysis::Argument Obfuscation
3) [B0030.002] Command and Control::Receive Data
4) [B0030.001] Command and Control::Send Data
5) [C0011.001] Communication Micro-objective::Resolve::DNS Communication
6) [C0002.014] Communication Micro-objective::Read Header::HTTP Communication
7) [C0003.003] Communication Micro-objective::Read Pipe::Interprocess Communication
8) [C0001.004] Communication Micro-objective::Connect Socket::Socket Communication
9) [C0001.011] Communication Micro-objective::Create TCP Socket::Socket Communication
10) [C0001.012] Communication Micro-objective::Get Socket Status::Socket Communication
11) [C0001.009] Communication Micro-objective::Initialize Winsock Library::Socket Communication
12) [C0001.006] Communication Micro-objective::Receive Data::Socket Communication
13) [C0001.007] Communication Micro-objective::Send Data::Socket Communication
14) [C0001.001] Communication Micro-objective::Set Socket Config::Socket Communication
15) [C0001.005] Communication Micro-objective::Start TCP Server::Socket Communication
16) [C0001.008] Communication Micro-objective::TCP Client::Socket Communication
17) [C0029] Cryptography Micro-objective::Cryptographic Hash
18) [C0031] Cryptography Micro-objective::Decrypt Data
19) [C0027.004] Cryptography Micro-objective::3DES::Encrypt Data
20) [C0027] Cryptography Micro-objective::Encrypt Data
21) [C0021.003] Cryptography Micro-objective::Use API::Generate Pseudo-random Sequence
22) [C0019] Data Micro-objective::Check String
23) [C0026.001] Data Micro-objective::Base64::Encode Data
24) [C0026.002] Data Micro-objective::XOR::Encode Data
27) [C0045] File System Micro-objective::Copy File
28) [C0046] File System Micro-objective::Create Directory
29) [C0047] File System Micro-objective::Delete File
30) [C0051] File System Micro-objective::Read File
31) [C0050] File System Micro-objective::Set File Attributes
32) [C0052] File System Micro-objective::Writes File
33) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
34) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
35) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
36) [C0040] Process Micro-objective::Allocate Thread Local Storage
37) [C0017] Process Micro-objective::Create Process
38) [C0038] Process Micro-objective::Create Thread
39) [C0041] Process Micro-objective::Set Thread Local Storage Value
40) [C0018] Process Micro-objective::Terminate Process