MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40b63ce7dff8a7941b067423a315cc2ac9d70e0d2309c2f9d9ac40ddcacababc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 35 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40b63ce7dff8a7941b067423a315cc2ac9d70e0d2309c2f9d9ac40ddcacababc
SHA3-384 hash: 3269b9cfa914c574859b48c8247740994190befdb223bd5cb52f7f1a0a9e74d5f22052eedd64d0c3aafb8d0fb3e32d1b
SHA1 hash: b602546c6599d53d2284cbf9cc03fc7a64021018
MD5 hash: a412f55d91d94f59ac35d024cc5e8bf5
humanhash: echo-bravo-aspen-video
File name:SecuriteInfo.com.Trojan-Dropper.Win32.Dapato.samj.28710.4304
Download: download sample
File size:43'136'944 bytes
First seen:2024-09-06 03:20:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b1c5e35cfdb33b753d65d387789d99f4
ssdeep 393216:hEr+7CAtJyEsYLrH95y/1uzVyQcNnxu+ds+o0ECKHOQKtuK+Vf6qrdWY6wdla9Fi:hdv86wQ0xYKQ8HFrsPFlXW6
TLSH T1B9978B0777E60195E5B3D2388AA75107E773B8675730CADF329C07152FABAD09A3A720
TrID 72.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
13.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.5% (.EXE) OS/2 Executable (generic) (2029/13)
2.5% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
File icon (PE):PE icon
dhash icon 6192a6a6a6a6c401 (17 x RedLineStealer, 11 x PythonStealer, 9 x DCRat)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
364
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan-Dropper.Win32.Dapato.samj.28710.4304
Verdict:
Malicious activity
Analysis date:
2024-09-06 03:34:12 UTC
Tags:
python evasion stealer
Link:
https://app.any.run/tasks/9517933d-0bd8-44b3-971b-63c7aae2c8dd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Clean
Score:
82.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66da75288e12b8124ac9561b
Tags:
t r o j a n d r o p p e r
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% directory
DNS request
Connection attempt
Sending a custom TCP request
Creating a file in the %temp% subdirectories
Deleting a recently created file
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Moving a file to the %temp% subdirectory
Creating a file
Сreating synchronization primitives
Enabling the 'hidden' option for recently created files
Launching a process
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
90%
Tags:
anti-debug crypto evasive expand fingerprint lolbin overlay packed
Link:
https://www.filescan.io/uploads/66da752112a3c42604115853/reports/cf7bbded-5b45-4dc6-9677-533f9c81885c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/40b63ce7dff8a7941b067423a315cc2ac9d70e0d2309c2f9d9ac40ddcacababc
Result
Verdict:
UNKNOWN
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1505362
Signature
AI detected suspicious sample
Multi AV Scanner detection for domain / URL
Behaviour
Behavior Graph:
Download SVG
Score:
11%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/40b63ce7dff8a7941b067423a315cc2ac9d70e0d2309c2f9d9ac40ddcacababc
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ic3dzz677ctzigygoqr2gfomfle5odqneme4f6ozvran3swkxk6a._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  9/10
Tags:
credential_access discovery persistence spyware stealer
Link:
https://tria.ge/reports/240906-dwb8jstfnf/
Behaviour
Detects videocard installed
GoLang User-Agent
Modifies system certificate store
Scheduled Task/Job: Scheduled Task
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Browser Information Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Credentials from Password Stores: Credentials from Web Browsers
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1110adfe-ba5f-45c3-8704-c103d724627f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/40b63ce7dff8a7941b067423a315cc2ac9d70e0d2309c2f9d9ac40ddcacababc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:APT_Bitter_ZxxZ_Downloader
Create hunting rule
Author:SECUINFRA Falcon Team (@SI_FalconTeam)
Description:Detects Bitter (T-APT-17) ZxxZ Downloader
Reference:https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh
Rule name:attack_India
Create hunting rule
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_Malicious_VBScript_Base64
Create hunting rule
Author:daniyyell
Description:Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.
Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:Mimikatz_Generic
Create hunting rule
Author:Still
Description:attempts to match all variants of Mimikatz
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments