MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f3cb5e1e9d9f3e4bc3844cd14ca1f6b0b00f85e309ab1705858893e8b0f1934. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Chthonic


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f3cb5e1e9d9f3e4bc3844cd14ca1f6b0b00f85e309ab1705858893e8b0f1934
SHA3-384 hash: f4c2819918839529d5ad5f874e0a0c09ef438c0add10604f75d6dfc6d72a73780a3312c554209fc21fe77cee98ff4aed
SHA1 hash: 25e376ca265ea6075cf20e2db44fc967d7a258b5
MD5 hash: a164d7455abcea239d9e0417b0a05c5d
humanhash: kentucky-oregon-single-california
File name:3f3cb5e1e9d9f3e4bc3844cd14ca1f6b0b00f85e309ab1705858893e8b0f1934
Download: download sample
Signature Chthonic
Create hunting rule
File size:205'824 bytes
First seen:2020-10-24 21:04:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ec4ccf61938fb650e052f9e77ba1b65e (1 x Chthonic)
ssdeep 3072:/hhDbsxC3e3gI3SOJ51nvH8/iaVwiQy4hKBtAQ3Zg5Rz34mTXzRQrppbLuaU5y:/hhyC3eR/J51Ra+NbhDeZg5p56rPd9
Threatray 212 similar samples on MalwareBazaar
TLSH 20149D8159A16071D5F7EC74106D9F21B62AB6C27C309FC497A85EEE09BC0B08F267F6
Reporter seifreed
Tags:Chthonic

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75246/
Detection(s):
Win.Packed.Lokibot-6331386-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Launching a process
DNS request
Unauthorized injection to a system process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/508702
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Sample uses process hollowing technique
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3f3cb5e1e9d9f3e4bc3844cd14ca1f6b0b00f85e309ab1705858893e8b0f1934/
Threat name:
Win32.Hacktool.CeeInject
Create hunting rule
Status:
Malicious
First seen:
2017-06-07 16:02:59 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
28 of 29 (96.55%)
Threat level:
  1/5
Verdict:
malicious
Label(s):
zloader
Create hunting rule
Similar samples:
0b37d287d10b55a50f1a717a015503b64d3be3586f15a12a0085d61794864235
Chthonic
15e9493c4f50b672fe801108d31ac6660d1d5787e0c71964a935a893aab12032
Chthonic
1d20f089698311891fac0a5cc2f3ecbfc1ce8e38d5e75a8a55b822324e8b1d35
Chthonic
2d02e69bdb215434458e28a4a8b2ccab2d2f4c176a175043e35284819aecd6db
Chthonic
6c759b96dca08330cce6b7787e69b286d3b1a22a618f81409fd674ef720eb6dd
Chthonic
7ab6936ad40377ecea070401a55ef15033c9ee2e441a2aaa0dc963a081502761
Chthonic
a270b677976266c10d5f062135372fd3f848f4b4dcfeaedd249d5069dc9e962e
Chthonic
b44cd4e38caab3aec3cd634a10f62e36021628ae9a16c0a577ce011fcf22b46f
Chthonic
c6035dfd95b359f00bc421c50365c58f55ffee88ff1f4223cad9d8fd4f9879a7
Chthonic
fcb6176fe71dbce1d5474b52e65726dfd4687c6b72f31e7099ac5d79328f681e
Chthonic
+ 202 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201024-sz73kz7tqs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
3f3cb5e1e9d9f3e4bc3844cd14ca1f6b0b00f85e309ab1705858893e8b0f1934
MD5 hash:
a164d7455abcea239d9e0417b0a05c5d
SHA1 hash:
25e376ca265ea6075cf20e2db44fc967d7a258b5
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/14df120b-54d9-4e6f-af12-a800d8b037bb/
SH256 hash:
5c8a02c62ac6191b6700ed5abf72e6912671a09e91c07cb0db73e6515f49de4f
MD5 hash:
b5bbdfc74ff57e1d2c356a45b5c7b49b
SHA1 hash:
1eebfeb9e1b7a32336305a78b25a4558d06e0947
Link:
https://www.unpac.me/results/14df120b-54d9-4e6f-af12-a800d8b037bb/
SH256 hash:
6ef3870a6e2b6f21a1beace9762404c46534a261036583a1bcf8e95d1600db37
MD5 hash:
465dd4bbe4a3a8219e57a9cf6aa25f82
SHA1 hash:
fcbc8fa981235f4506f6e58e8ccc0e0b732a7c6d
Link:
https://www.unpac.me/results/14df120b-54d9-4e6f-af12-a800d8b037bb/
SH256 hash:
c327d6b4fece8a419c4a0822a82a994e516bdd1a6fd574ca1f2954da523fe782
MD5 hash:
eddf4d1740bff80f4b3abc236cb2ad5b
SHA1 hash:
b5e068fc94aa01286c4b96954ece7d049a712f64
Detections:
win_zloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/14df120b-54d9-4e6f-af12-a800d8b037bb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dofoil
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3f3cb5e1e9d9f3e4bc3844cd14ca1f6b0b00f85e309ab1705858893e8b0f1934

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_nymaim_g0
Create hunting rule
Author:mak, msm, CERT.pl
Rule name:win_zloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_zloader_g1
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/75246/

Comments