MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ef14f469d7554de72cb7845067af1ae991ed2114d09ba6f4e913787f24c61c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ef14f469d7554de72cb7845067af1ae991ed2114d09ba6f4e913787f24c61c1
SHA3-384 hash: 61746bfd03a02f1361794c4b4d7d0d09ca1d9a576483a29ca9d39677392dc2c8d776e1e7b008d4d4ea0942cc3a18232d
SHA1 hash: e7ac51f08b8dbe1307a95adf5b7cdb52db1adfad
MD5 hash: b5bb6281c6ca47ed0702297380de7786
humanhash: one-oregon-stream-kilo
File name:SecuriteInfo.com.Win32.Malware.KillAV.6KOMSE@gen.22946.22832
Download: download sample
File size:13'325'768 bytes
First seen:2024-02-05 14:28:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0251e6664db616f9371719b21e982f5c
ssdeep 196608:xwKQggItK4DBVcjTQMj8Bs33cPQ3gnnx00TADm/qUgtXeiq+Dncy4/z0ynFLOyoh:1Bdk9sRQZ9mgleiq+DrMz9F4
Threatray 140 similar samples on MalwareBazaar
TLSH T1E8D613223EDD507AD47316328FEDB3B8A66FBEB06635025725903E3EBE717414918923
TrID 48.1% (.OCX) Windows ActiveX control (116521/4/18)
23.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
17.1% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
4.3% (.EXE) Win64 Executable (generic) (10523/12/4)
2.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon d2ceb2caca94d6e4
Reporter SecuriteInfoCom
Tags:exe signed

Code Signing Certificate

Organisation:RaonSecure Co., Ltd.
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2023-08-22T00:00:00Z
Valid to:2026-10-04T23:59:59Z
Serial number: 065bea97b30f108182beeec674279a6e
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: a7a17847418cb74e052e72d3f64a3d4919045e85c704c4dd943581ca7b704d72
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
287
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Malware.KillAV.6KOMSE@gen.22946.22832.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Johnnie-6912799-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm anti-vm buer CAB cmd crypto dllhost evasive explorer explorer fingerprint hacktool hook installer keylogger lolbin mmc msbuild overlay packed regsvr32 rundll32 setupapi shell32 stealer tracker vsjitdebugger wuauclt
Link:
https://www.filescan.io/uploads/65c0f0b4a858ab3d210a7e81/reports/ad50a3bb-b245-474b-8f32-8a09674a4c80/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/3ef14f469d7554de72cb7845067af1ae991ed2114d09ba6f4e913787f24c61c1
Result
Verdict:
MALICIOUS
Malware family:
Sysinternals
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/0ad923e6-6b0c-497d-a1ec-a3b7708d5298
Result
Threat name:
n/a
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
63 / 100
Link:
https://www.joesandbox.com/analysis/1386833
Signature
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to register a low level keyboard hook
Creates an undocumented autostart registry key
Installs a global get message hook
Installs a global keyboard hook
Installs new ROOT certificates
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Overwrites Mozilla Firefox settings
Sigma detected: System File Execution Location Anomaly
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1386833 Sample: SecuriteInfo.com.Win32.Malw... Startdate: 05/02/2024 Architecture: WINDOWS Score: 63 92 NDIS Filter Driver detected (likely used to intercept and sniff network traffic) 2->92 94 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->94 96 Sigma detected: System File Execution Location Anomaly 2->96 98 Contains functionality to compare user and computer (likely to detect sandboxes) 2->98 9 SecuriteInfo.com.Win32.Malware.KillAV.6KOMSE@gen.22946.22832.exe 10 20 2->9         started        13 TENXW_SVR.exe 2->13         started        15 ObCrossEXService.exe 2->15         started        process3 file4 76 C:\...\raon_touchenex_Install.exe, PE32 9->76 dropped 78 C:\Program Files\RaonSecure\...\TEWeb64.exe, PE32+ 9->78 dropped 80 C:\Program Files\RaonSecure80xWeb\TEWeb.exe, PE32 9->80 dropped 82 12 other files (2 malicious) 9->82 dropped 110 Contains functionality to register a low level keyboard hook 9->110 112 Contains functionality to compare user and computer (likely to detect sandboxes) 9->112 17 FFCert.exe 9->17         started        20 raon_touchenex_Install.exe 33 32 9->20         started        23 CrossEX_LocalService_Install.exe 10 26 9->23         started        25 TEWeb.exe 2 1 13->25         started        27 TEWeb64.exe 13->27         started        29 TEWebP.exe 13->29         started        signatures5 process6 file7 58 C:\Users\user\AppData\Local\...\certutil.exe, PE32 17->58 dropped 60 C:\Users\user\...\Firefox_CertUtil.exe, PE32 17->60 dropped 70 13 other files (none is malicious) 17->70 dropped 31 Firefox_CertUtil.exe 17->31         started        62 C:\Users\user\AppData\Local\...\System.dll, PE32 20->62 dropped 72 5 other files (none is malicious) 20->72 dropped 100 Creates an undocumented autostart registry key 20->100 102 Installs new ROOT certificates 20->102 64 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 23->64 dropped 66 C:\Users\user\AppData\Local\...\System.dll, PE32 23->66 dropped 74 3 other files (none is malicious) 23->74 dropped 34 sc.exe 1 23->34         started        36 sc.exe 1 23->36         started        38 sc.exe 1 23->38         started        40 CrossEXService.exe 23->40         started        68 C:\Windows\TNXNet64.sys, PE32+ 25->68 dropped 104 Installs a global get message hook 25->104 106 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 25->106 108 Installs a global keyboard hook 25->108 signatures8 process9 signatures10 118 Tries to harvest and steal browser information (history, passwords, etc) 31->118 42 certutil.exe 31->42         started        46 certutil.exe 31->46         started        48 conhost.exe 34->48         started        50 conhost.exe 36->50         started        52 conhost.exe 38->52         started        process11 file12 84 C:\Users\user\AppData\...\key4.db-journal, SQLite 42->84 dropped 86 C:\Users\user\AppData\Roaming\...\key4.db, SQLite 42->86 dropped 88 C:\Users\user\AppData\...\cert9.db-journal, SQLite 42->88 dropped 90 C:\Users\user\AppData\Roaming\...\cert9.db, SQLite 42->90 dropped 114 Overwrites Mozilla Firefox settings 42->114 116 Tries to harvest and steal browser information (history, passwords, etc) 42->116 54 conhost.exe 42->54         started        56 conhost.exe 46->56         started        signatures13 process14
Score:
41%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/3ef14f469d7554de72cb7845067af1ae991ed2114d09ba6f4e913787f24c61c1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ef14f469d7554de72cb7845067af1ae991ed2114d09ba6f4e913787f24c61c1/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h3yu6ru5ovkn44wlpbcqm6xrv2mr5uqrjue3u32ose3yp4smmhaq._file
Verdict:
unknown
Similar samples:
06ece311c226daf62863e5791def4efee02dacfeacc6b7635095d0a63b715a99
083842534185758ad03c0a124d2a0a629225d97f3e3c4776c1ff727adeaae4c6
193351df6e24e833b30dcfc1dc3be94882c33a79e5bf8a6d76f51256d4b090d5
265cb456cf5a09ad82380cb98118fb9255a9c9407085677d597abd828a5f4b11
2d5c9b33ed298f5fb67ce869c74b2f2ec9179a924780da65fcbc1a0e0463c5d0
36de150cba3d3477191cbe04958e9f887725df1e2e21a92cb18887620238dea2
4bf1915785d7c6e0987eb9c15857f7ac67dc365177a1707b14822131d43a6166
6dff42544f3d0b8331c254810dbc9f0e5c26f375eac48e38eefe63785f99eaa2
c55316b1bc9ae50e0ab6703a05d1d0a052221a60d5166b4e19bf43aed8fb4936
e3b0a6b1e8aa4cc6407d49b2bc8607549fc5b25cd2b11fc66a41127266c3ca47
+ 130 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery persistence spyware stealer
Link:
https://tria.ge/reports/240205-rtknssbhcj/
Behaviour
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
NSIS installer
Enumerates physical storage devices
Checks installed software on the system
Drops file in Program Files directory
Drops file in Windows directory
Executes dropped EXE
Launches sc.exe
Loads dropped DLL
Checks computer location settings
Adds Run key to start application
Reads user/profile data of web browsers
Creates new service(s)
Unpacked files
SH256 hash:
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6
MD5 hash:
3d366250fcf8b755fce575c75f8c79e4
SHA1 hash:
2ebac7df78154738d41aac8e27d7a0e482845c57
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 hash:
b0c77267f13b2f87c084fd86ef51ccfc
SHA1 hash:
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
ffc7558a61a4e6546cf095bdeabea19f05247a0daa02dca20ea3605e7fc62c77
MD5 hash:
269beb631b580c6d54db45b5573b1de5
SHA1 hash:
64050c1159c2bcfc0e75da407ef0098ad2de17c8
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be
MD5 hash:
ca95c9da8cef7062813b989ab9486201
SHA1 hash:
c555af25df3de51aa18d487d47408d5245dba2d1
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
e3227ea4c39f5b44f685eea13d9f6663945e46b12cabe5d29daef28b6eef1a9b
MD5 hash:
717dbdf0e1f616ea8a038259e273c530
SHA1 hash:
926ce8ec8f79b62202ed487c5fb0c3e1a18f5f70
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
e1b358325eb3d27395db248bc6a2bcc3f310c91e6d3ca9accefa50f41db62499
MD5 hash:
b4968bf6adb62ea03519705caedcb842
SHA1 hash:
8c17c9f99ce163c931451773aaafa36282bb61c7
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
d779537f46df621c2db6d04c77a5a3bdde3a464e4e0951f6797e63ca07a25224
MD5 hash:
30cf7172697dbc58fc7ac7d6f2272b8d
SHA1 hash:
c7d4e52f933b42a2749ec0bf7117fb02a92ddaa2
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
b3cfee29db6350c4efbddcc3f3e99896b6c33b03010e1aec85788c6d25a4dd59
MD5 hash:
9199d5085a46c25387fb12a4db933da1
SHA1 hash:
b91b383ecbfff4d81b523c8948d1fc1a4caff0af
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
aba2732c7a016730e94e645dd04e8fafcc173fc2e5e2aac01a1c0c66ead1983e
MD5 hash:
a5c670edf4411bf7f132f4280026137b
SHA1 hash:
c0e3cbdde7d3cebf41a193eeca96a11ce2b6da58
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
93e99cfba00348be3a102dc9f41acd39bba91d7f4e0149a9ea6c53fcc50adaee
MD5 hash:
d1243817a1b22b855de0852cf5b53bf5
SHA1 hash:
c64f4851a2fcfe8d1e4a5b5743498870b676755e
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
8eca993570fa55e8fe8f417143eea8128a58472e23074cbd2e6af4d3bb0f0d9a
MD5 hash:
051652ba7ca426846e936bc5aa3f39f3
SHA1 hash:
0012007876dde3a2d764249ad86bc428300fe91e
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
751c2156dc00525668dd990d99f7f61c257951c3fad01c0ee6359fcdff69f933
MD5 hash:
1fae68b740f18290b98b2f9e23313cc2
SHA1 hash:
fa3545dc8db38b3b27f1009e1d61dc2949df3878
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 hash:
bf38660a9125935658cfa3e53fdc7d65
SHA1 hash:
0b51fb415ec89848f339f8989d323bea722bfd70
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
5950722034c8505daa9b359127feb707f16c37d2f69e79d16ee6d9ec37690478
MD5 hash:
0c6b43c9602f4d5ac9dcf907103447c4
SHA1 hash:
7a77c7ae99d400243845cce0e0931f029a73f79a
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
439694a70baeb06abc38791c679b3042ecd5320ab08df6ed837c5cc58fc0903e
MD5 hash:
5ece0a8df062fec5f921f5c14891c31e
SHA1 hash:
7f07f7a23465db46bc3618a4eda9fbbdecdac501
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
3f997d3f1674de9fd119f275638861bc229352f12c70536d8c83a70fcc370847
MD5 hash:
a1c4628d184b6ab25550b1ce74f44792
SHA1 hash:
c2c447fd2fda68c0ec44b3529a2550d2e2a8c3bc
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
38a906373419501966daf6ec19ca2f8db7b29609128ae5cb424d2aa511652c29
MD5 hash:
9ae76db13972553a5de5bdd07b1b654d
SHA1 hash:
0c4508eb6f13b9b178237ccc4da759bff10af658
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
22ecece561510f77b100cff8109e5ed492c34707b7b14e0774aaa9ca813de4ad
MD5 hash:
2ab31c9401870adb4e9d88b5a6837abf
SHA1 hash:
4f0fdd699e63f614d79ed6e47ef61938117d3b7a
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
1c158e680749e642e55f721f60a71314e26e03e785cd92e560bf650b83c4c3c8
MD5 hash:
6e84af2875700285309dd29294365c6a
SHA1 hash:
fc3cb3b2a704250fc36010e2ab495cdc5e7378a9
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
1af1ac51a92b36de8d85d1f572369815404912908c3a489a6cd7ca2350c2a93d
MD5 hash:
c26e940b474728e728cafe5912ba418a
SHA1 hash:
7256e378a419f8d87de71835e6ad12faadaaaf73
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
00db98ab4d50e9b26ecd193bfad6569e1dd395db14246f8c233febba93965f7a
MD5 hash:
b58848a28a1efb85677e344db1fd67e6
SHA1 hash:
dad48e2b2b3b936efc15ac2c5f9099b7a1749976
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
3d32c106d15438eccc2157bb4ba7730624985fac371f88c53ca3c10d60b1732a
MD5 hash:
e28dbb0eebeb3c1f2436de5cbf83a821
SHA1 hash:
43a8c9a5464aa36ce4953958b53fa6e8dbcb3384
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
d3e3c2cb3c509647677abd2999b38d279f1361d739f927cbc54ef53bf0056d78
MD5 hash:
e56e7aeb3cbbbdf72dab1ecab2f11fff
SHA1 hash:
6c49fa98f6f15bfe3a47de6f2fcfcf32766aa9fd
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
bb7e367bee3e91651d444db3c2f0997de914650547c66473bb201a2724d49196
MD5 hash:
6ea4aa54a7837e790c0b822dc8c27cd6
SHA1 hash:
1ed173163c496c482b36ef737fb6832e2b82cb6e
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
c43480822d0af22e4230a0aee184efc8427694725adfcbe6966b6c6e5ed7783b
MD5 hash:
f89d16247830572e105bd943a81ef41c
SHA1 hash:
f11881b2258f7d9a367a9dcac8f74d93801894d4
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
795030540b9a55127f5068c564cba64e532a48bf10921e47e8a9832793e11f0c
MD5 hash:
13fac4948acdc5db17d54c2f482dffc1
SHA1 hash:
36ced90aab398e983ae8e6d962ff7e637ef0a767
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
SH256 hash:
3ef14f469d7554de72cb7845067af1ae991ed2114d09ba6f4e913787f24c61c1
MD5 hash:
b5bb6281c6ca47ed0702297380de7786
SHA1 hash:
e7ac51f08b8dbe1307a95adf5b7cdb52db1adfad
Link:
https://www.unpac.me/results/484bd250-bef1-41ed-b15d-d205c317cc27/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ef14f469d7554de72cb7845067af1ae991ed2114d09ba6f4e913787f24c61c1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments