MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4075d7da24714cf3111933be4cb9d27074be68c5fd8bc2ef5c47f3d57142031a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	4075d7da24714cf3111933be4cb9d27074be68c5fd8bc2ef5c47f3d57142031a
SHA3-384 hash:	8a9dd32bd56f8454e95b2beda27a86b822c1a10c8817f35b131260a5554c90512df16a7da50188291d3048a1637d0027
SHA1 hash:	16936d10f53cdfd71add92666a1397895809ec7c
MD5 hash:	bdab7fe075f142bee1745ac1ea2710fc
humanhash:	spring-spring-eighteen-blossom
File name:	Return-of-Space-Setup.rar
Download:	download sample
File size:	71'702'575 bytes
First seen:	2024-04-30 09:55:01 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	1572864:E/WHHr9+nClTdgdwaAFaP0fT1Ln7d2u0ycVZKDrFqc1JkU7x:E/8L9oCJdZaAqyxLnLlcVZKDsU7x
TLSH	T1B3F7336953984B7EFD9EB93C55220B477CF37AC00D719B5883C16BF209B25A42C98D2E
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	NDA0E
Tags:	rar ReturnofSpace returnofspace.com WaveStealer

NDA0E

Distributed via: returnofspace.com

https://returnofspace.com/ > Download > https://returnofspace.com/download/Return-of-Space-Setup.rar

WaveStealer C2: wavebysudryez.fr

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Return-of-Space-Setup.exe
File size:	71'702'379 bytes
SHA256 hash:	4666136af195e1a16495d119c585bfca0c72aa5fbbb01cc147ed6f903f0ce27b
MD5 hash:	89bc82314aca90ff5f717a05bb487343
MIME type:	application/x-dosexec

Vendor Threat Intelligence

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/6630c00575339da04fa78e1a/reports/217df1a4-dc4c-4e4e-b326-45e349151a75/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4075d7da24714cf3111933be4cb9d27074be68c5fd8bc2ef5c47f3d57142031a

Score:

66%

Verdict:

Susipicious

File Type:

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/240430-l58xwahf57/

Behaviour

Checks processor information in registry

Enumerates processes with tasklist

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.