MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d131ee244187188c98d903cf951a764244daa1d16855ac5c923fd0173589ff5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d131ee244187188c98d903cf951a764244daa1d16855ac5c923fd0173589ff5
SHA3-384 hash: 49eb180821d7d1e302cb6b22b7459768f2d569385fd0d33c4f638786fb8012e2403e14b575bd433073328bb6b0de2f7e
SHA1 hash: 20e39b66ddfacc6d2b7f2c6266c6df88040cca83
MD5 hash: 7c225f12d4a612c304d57f9131bf0f30
humanhash: lemon-march-spring-grey
File name:7c225f12d4a612c304d57f9131bf0f30.exe
Download: download sample
File size:395'264 bytes
First seen:2022-09-13 17:46:32 UTC
Last seen:2022-09-13 18:55:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a490e3ca20f57194cb1f4b473b3242c4 (17 x RedLineStealer, 1 x ArkeiStealer)
ssdeep 6144:4GscBjzBoH59DCiPg2FbXdr/953YZgLKF44sXhWkjLzbCTHH17s60EyJBA5o5:4GThoHLDHgaR/PKF+4pN0K
TLSH T13B847CBA2A24C43ED082B5BF04ABB5B1783CACB477A077917495B277E3722493F059C5
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
257
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/309783/
Detection(s):
SecuriteInfo.com.Variant.Lazy.242965.3609.18026.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Creating a file in the Windows subdirectories
Running batch commands
Creating a process from a recently created file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6320c22511830460749c57e9/reports/46d0b526-15b4-4781-b4c0-021e26ecc0b9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/cb5d3917-396a-4fe1-a662-e8dcf231be6e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1069708
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 702244 Sample: D9LLlsJkIn.exe Startdate: 13/09/2022 Architecture: WINDOWS Score: 72 47 Multi AV Scanner detection for submitted file 2->47 49 .NET source code contains method to dynamically call methods (often used by packers) 2->49 51 Machine Learning detection for sample 2->51 9 D9LLlsJkIn.exe 1 2->9         started        13 Clipper.exe 1 2->13         started        15 Clipper.exe 1 2->15         started        process3 file4 39 C:\Users\user\AppData\...\D9LLlsJkIn.exe.log, ASCII 9->39 dropped 53 Contains functionality to inject code into remote processes 9->53 55 Injects a PE file into a foreign processes 9->55 17 D9LLlsJkIn.exe 15 4 9->17         started        57 Multi AV Scanner detection for dropped file 13->57 21 conhost.exe 13->21         started        23 conhost.exe 15->23         started        signatures5 process6 dnsIp7 43 cdn.discordapp.com 162.159.134.233, 443, 49721 CLOUDFLARENETUS United States 17->43 45 192.168.2.1 unknown unknown 17->45 37 C:\Windows\Temp\xsv.exe, PE32+ 17->37 dropped 25 cmd.exe 1 17->25         started        27 conhost.exe 17->27         started        file8 process9 process10 29 xsv.exe 1 7 25->29         started        33 conhost.exe 25->33         started        file11 41 C:\Users\user\AppData\Roaming\...\Clipper.exe, PE32+ 29->41 dropped 59 Multi AV Scanner detection for dropped file 29->59 35 conhost.exe 29->35         started        signatures12 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d131ee244187188c98d903cf951a764244daa1d16855ac5c923fd0173589ff5/
Threat name:
ByteCode-MSIL.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-09-13 11:50:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hujr5ysedbyyrsmnsa6psunhmqse3kq5c2cvvrojep6qc42yt72q._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/220913-wcvvnagbe4/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Downloads MZ/PE file
Executes dropped EXE
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8447e9f7-eeec-4230-acf7-ac2acd0c2294
Unpacked files
SH256 hash:
11bb034636e1277c40ee6272b5d8478bc42fd0443a4987686461052c68b11c81
MD5 hash:
17fdf18364437fc0166c69da2059a830
SHA1 hash:
01ca006fb1b0c77cca2b3308b60b7d87dc127f3c
Link:
https://www.unpac.me/results/6b0dcddb-f393-43e8-9b84-09012ed04294/
SH256 hash:
3d131ee244187188c98d903cf951a764244daa1d16855ac5c923fd0173589ff5
MD5 hash:
7c225f12d4a612c304d57f9131bf0f30
SHA1 hash:
20e39b66ddfacc6d2b7f2c6266c6df88040cca83
Link:
https://www.unpac.me/results/6b0dcddb-f393-43e8-9b84-09012ed04294/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3d131ee244187188c98d903cf951a764244daa1d16855ac5c923fd0173589ff5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 3d131ee244187188c98d903cf951a764244daa1d16855ac5c923fd0173589ff5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2301799/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/309783/

Comments