MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fcd2992862f0de5f0ca0c5ec05fe65ad8619702da3cd2b46379e447470e2421. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fcd2992862f0de5f0ca0c5ec05fe65ad8619702da3cd2b46379e447470e2421
SHA3-384 hash: 32dab41db90f3e04c2df50b7b07cf3e75270e72fe04d08d199c9205de041bf943f37444ac0fa588224be4c357fffea8b
SHA1 hash: 5551fb906da3d04f5d85c106d334ec286d1adf1e
MD5 hash: ae444e299353e6a9f669ff784cb075ed
humanhash: arizona-football-paris-william
File name:t2.hta
Download: download sample
File size:343'007 bytes
First seen:2024-09-03 15:43:34 UTC
Last seen:2024-09-03 16:49:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f80bc97436232f135d9706a88c8c960e (1 x Emmenhtal)
ssdeep 6144:0VYIbMos9I7CVYIbMos9I7NVYIbMos9I73VYIbMos9I7:0VYIoos9I7CVYIoos9I7NVYIoos9I73d
Threatray 1 similar samples on MalwareBazaar
TLSH T1F2740803BAC7413CEBE35932415EFA5856A5E43F070D1BAF37A06955C805AE3AB382DD
TrID 51.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.2% (.EXE) Win64 Executable (generic) (10523/12/4)
10.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.3% (.EXE) Win32 Executable (generic) (4504/4/1)
3.3% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
File icon (PE):PE icon
dhash icon f8697868b2f069d4 (5 x DarkVisionRAT, 1 x Worm.Virut, 1 x Emmenhtal)
Reporter aachum
Tags:hta


Avatar
iamaachum
https://getyourpages.com/downloads/t2

Intelligence

File Origin
# of uploads :
2
# of downloads :
115
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
provenotrobot.bcdn.net.ps1
Verdict:
Malicious activity
Analysis date:
2024-09-03 15:31:53 UTC
Tags:
loader lumma stealer exfiltration
Link:
https://app.any.run/tasks/3f92c26a-15aa-46b4-9159-4aa1ea37c9d9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.6540.4626.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66d72ec8f3d7ccf99f8fc4ad
Tags:
Encryption Static
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto epmicrosoft_visual_cc fingerprint masquerade microsoft_visual_cc overlay stealer
Link:
https://www.filescan.io/uploads/66d72ec408bf8bf8e85c1411/reports/b019683a-4f9f-4510-a0f4-3a3530462558/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/3fcd2992862f0de5f0ca0c5ec05fe65ad8619702da3cd2b46379e447470e2421
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
MustardSandwich
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a3199e84-ad9c-46c6-b456-7eaed1c45b8d
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1503612
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1503612 Sample: t2.hta.exe Startdate: 03/09/2024 Architecture: WINDOWS Score: 48 13 Multi AV Scanner detection for submitted file 2->13 6 t2.hta.exe 1 2->6         started        process3 dnsIp4 11 1.1.1.1.in-addr.arpa 6->11 9 conhost.exe 6->9         started        process5
Score:
90%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3fcd2992862f0de5f0ca0c5ec05fe65ad8619702da3cd2b46379e447470e2421
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3fcd2992862f0de5f0ca0c5ec05fe65ad8619702da3cd2b46379e447470e2421/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h7gsteugf4g6l4gkbrpmax7gllmgdfyc3i6nfnddphseoryoeqqq._file
Verdict:
unknown
Similar samples:
f9017da9bf07e1821c95ffabafb0ca8c36ffe3af3cd8a80ec3c9d6060b8d49df
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/240903-s6gnca1hkf/
Behaviour
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/55295d1e-bf22-4aa4-b838-e9c2df05f442
Unpacked files
SH256 hash:
3fcd2992862f0de5f0ca0c5ec05fe65ad8619702da3cd2b46379e447470e2421
MD5 hash:
ae444e299353e6a9f669ff784cb075ed
SHA1 hash:
5551fb906da3d04f5d85c106d334ec286d1adf1e
Detections:
win_Emmenhtal_w0
Create hunting rule
Link:
https://www.unpac.me/results/fbc0aea7-28bd-44b0-80b5-3f62fba07f47/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3fcd2992862f0de5f0ca0c5ec05fe65ad8619702da3cd2b46379e447470e2421

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_Malicious_VBScript_Base64
Create hunting rule
Author:daniyyell
Description:Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.
Rule name:EmmenHTAl
Create hunting rule
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PowerShell (PS) ps1 836ffd22263c910babc25497ac16ac849ec3ee9836691e9f8cf68ae4aa1fbf4e

Executable exe 3fcd2992862f0de5f0ca0c5ec05fe65ad8619702da3cd2b46379e447470e2421

(this sample)

LummaStealer

Executable exe bbcf22aa482ee7f3cf7d9defdad1df591e354264609814a62d4b3fb42bb5ecbe

  
Dropped by
SHA256 836ffd22263c910babc25497ac16ac849ec3ee9836691e9f8cf68ae4aa1fbf4e
  
Delivery method
Distributed via web download
  
Dropping
SHA256 bbcf22aa482ee7f3cf7d9defdad1df591e354264609814a62d4b3fb42bb5ecbe
  
Dropping
MD5 a6f91cf6fdca195778e89e32efdfcd97
  
Dropped by
MD5 bdf2ab5fbe5eb3ac97ab01d85667a6ba

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
DNS_APIPerforms DNS callsDNSAPI.dll::DnsQueryConfigAllocEx
KERNEL_APIManipulates Windows Kernel & Driversntdll.dll::RtlInitString
WIN_BASE_APIUses Win Base APIapi-ms-win-core-processthreads-l1-1-0.dll::TerminateProcess
WIN_CRYPT_APIUses Windows Crypt APICRYPT32.dll::CryptBinaryToStringA
WIN_SOCK_APIUses Network to send and receive dataWS2_32.dll::freeaddrinfo
WS2_32.dll::getaddrinfo

Comments