MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f64e635a811969032be1c3bd6d467b6edae118ea00996a66e56e9d798a4db03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3f64e635a811969032be1c3bd6d467b6edae118ea00996a66e56e9d798a4db03
SHA3-384 hash:	ece9aa9e578751b4c2d0793c6e64073fb8931ab8beb8396200e484dda658df4d6033885f63633a5117653dc920fda7ce
SHA1 hash:	82f8fa80e39202cd2388bfbd1482b8626008907b
MD5 hash:	c8311dd3d3421e1159a669be44e14287
humanhash:	earth-leopard-finch-twelve
File name:	SecuriteInfo.com.Trojan.Uztuby.4.25865.409
Download:	download sample
File size:	1'902'871 bytes
First seen:	2023-06-29 08:29:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	aac51396886833dc961fcd7aab7711e4 (11 x NetSupport, 7 x DCRat, 4 x njrat)
ssdeep	49152:5FPDcoooVguPMjxqFmA1p3N5xeqEJPpP0o3CpkRzRJpi:5UMvPMj2P3N5xe/FCkzRO
Threatray	538 similar samples on MalwareBazaar
TLSH	T1A5952303B5C185F2D03728336A361B20A6BCBD301F558ADF67C9251E9E736D1AA317A7
TrID	91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) 0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

304

Origin country :

FR

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

SecuriteInfo.com.Trojan.Uztuby.4.25865.409

Verdict:

Suspicious activity

Analysis date:

2023-06-29 08:31:18 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e580492f-4d83-4c73-b9fe-7077aff829bc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/403717/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Uztuby.4.25865.409.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Launching a process

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/94052/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-vm crypto fauppod greyware lolbin lolbin masquerade msiexec overlay packed packed replace setupapi shdocvw shell32

Link:

https://www.filescan.io/uploads/649d410e313e9da61a5bdbce/reports/c5f514e0-1442-4519-947d-172214e7822c/overview

Hybrid Analysis Trojan.Uztuby

Verdict:

Malicious

Labled as:

Trojan.Uztuby

Link:

https://www.hybrid-analysis.com/sample/3f64e635a811969032be1c3bd6d467b6edae118ea00996a66e56e9d798a4db03

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/81f714f3-7fd5-410a-af45-a812410168ae

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1263141

Signature

Multi AV Scanner detection for submitted file

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3f64e635a811969032be1c3bd6d467b6edae118ea00996a66e56e9d798a4db03/

ReversingLabs TitaniumCloud Win32.Trojan.Amadey

Threat name:

Win32.Trojan.Amadey

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-29 08:30:08 UTC

File Type:

PE (Exe)

Extracted files:

18

AV detection:

15 of 24 (62.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h5somnnicgljamv6dq55nvdhw3w24emouaeznjtok3u5pgfe3mbq._file

Threatray malicious

Verdict:

malicious

Similar samples:

0aed3882e07ef8574cdbb90140442e038e11eff10df31c84025daceeaf50877a

0af3aa9e62ae449301ef9b3d9965d45775c13b2fc7a662795d39585d5c0fa908

18ab5e7a8a16ee97cfaf8d710e023a7816f0e0c6e57c1d6ca2f9ca311db0dd12

35e5460c102ca2f996d61d70d6bb06fb87014f7d2beccf35f3812ea534acd9d5

8525d0bc1e38bb74d592de9be2615da94ec0b81e611b0e456b3a51c40ab5baa3

a040c35ef32cbe289d5bc2b8014adcb961ab3aed1e2873d1f2e335933e97927b

d102af126bcff04b5b089f3872b3add0fef3e755eea0182e8f28324b3c5dcc5f

e905f262f2ec981ddf92c94fe44d96c14195f9bf0815f204c2c4197b16dbb053

fba557d1ea30dc5810637b80408cc8d6491f33e5cb4def703f2b3413d476d93d

+ 528 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230629-kd568sdd2z/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

d5155ea5c75a24ee78b9dc56008099197ccfbc37e747ae3b323cf27fbaadaaa1

MD5 hash:

66cf90d9dfe78192bc15de52da02ace7

SHA1 hash:

650f056ffb49a1d25252ce892ed8318411aef6fa

Link:

https://www.unpac.me/results/f64c8df2-e1ba-4d01-9dcf-87d318b5f15d/

SH256 hash:

3f64e635a811969032be1c3bd6d467b6edae118ea00996a66e56e9d798a4db03

MD5 hash:

c8311dd3d3421e1159a669be44e14287

SHA1 hash:

82f8fa80e39202cd2388bfbd1482b8626008907b

Link:

https://www.unpac.me/results/f64c8df2-e1ba-4d01-9dcf-87d318b5f15d/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/403717/