MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4059e86442fcc461c1a3b980dd668a8af43f08a8d2c4bf610dac1162feff596e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4059e86442fcc461c1a3b980dd668a8af43f08a8d2c4bf610dac1162feff596e
SHA3-384 hash: 5311b0998e4de5e33fc290571f48edc1980e65754984a6c432e629becb3b7fd4bf134ae50ae691ddf17fa94898e9702c
SHA1 hash: 6f4b72aea6acc99116aed1ff3a1c7b486a4a7f62
MD5 hash: d1dd37665acc71e23a8b7db3e2b064c4
humanhash: missouri-timing-oklahoma-two
File name:Cheater.Pro.1.6.0.zip
Download: download sample
File size:1'378'509 bytes
First seen:2024-03-15 15:44:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:Qo/ipPnDwsMUDiK5djxZIra1sHRH4tAEgAPFIyFZsN0EoiboBBpY4QvZL:ZrUddjxZ+aGxHkNhZsNPouuprQhL
TLSH T13655336801EDD313DDB21F70E9BAF4BF38DD91C218A730A82A5597A25064ADF1E8DC35
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter e24111111111111
Tags:cheaterpro.live RedLineStealer zip


Avatar
e24111111154168
Distributed via: cheaterpro.live

Intelligence

File Origin
# of uploads :
1
# of downloads :
249
Origin country :
GR GR
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Cheater Pro 1.6.0.msi
File size:2'450'944 bytes
SHA256 hash: b9f0f29ab0015b207fc68d51ffb2a98813e69401c49b5ad505419d5fcbc6b33e
MD5 hash: 798e2c0dfd79867c67973832c8a09e74
MIME type:application/x-msi
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.HEUR.Trojan-Spy.OLE2.Agent.gen.19928.23885.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm evasive fingerprint lolbin masquerade remote shell32
Link:
https://www.filescan.io/uploads/65f46d00757c624818ae547e/reports/0f3b67d6-4d90-4fe7-87f1-983b6e769c4b/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/4059e86442fcc461c1a3b980dd668a8af43f08a8d2c4bf610dac1162feff596e
Score:
9%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/4059e86442fcc461c1a3b980dd668a8af43f08a8d2c4bf610dac1162feff596e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4059e86442fcc461c1a3b980dd668a8af43f08a8d2c4bf610dac1162feff596e/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ibm6qzcc7tcgdqndxgan2zukrl2d6cfi2lcl6yinvqiwf7x7lfxa._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/240315-tfm8wace7v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Loads dropped DLL
Enumerates connected drives
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4059e86442fcc461c1a3b980dd668a8af43f08a8d2c4bf610dac1162feff596e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_LATAM_MSI_Banker
Create hunting rule
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 4059e86442fcc461c1a3b980dd668a8af43f08a8d2c4bf610dac1162feff596e

(this sample)

Microsoft Software Installer (MSI) msi b9f0f29ab0015b207fc68d51ffb2a98813e69401c49b5ad505419d5fcbc6b33e

  
Dropping
SHA256 b9f0f29ab0015b207fc68d51ffb2a98813e69401c49b5ad505419d5fcbc6b33e
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2783864/

Comments