MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 419dfd4197486fb8219fd61895008efbfe8b628f96865dec3bbd054eb900bf13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 419dfd4197486fb8219fd61895008efbfe8b628f96865dec3bbd054eb900bf13
SHA3-384 hash: c242c8d34b09260031fa742c4ee012d8aaef6748e5680296504197a9d7855535a5e7d08a840b9887383c1bba66f26494
SHA1 hash: a82cdf3dbd7f48aac025a694a0ea95af2a8fd7d2
MD5 hash: 014f151532a5e0fd0f9f6675709517af
humanhash: item-mockingbird-echo-table
File name:EVOLUTION TRADE Sp. Zoo. (OFERTA 092127).exe
Download: download sample
File size:844'288 bytes
First seen:2021-09-28 08:46:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c00b6ba7dbbc6abee9ace3a65a49ba24 (6 x Renamer, 1 x Worm.Ramnit)
ssdeep 12288:OwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4FhozEJ888888888888W8888888J:eNzCtUpQ9WWPBSSRMTEpMN5
Threatray 44 similar samples on MalwareBazaar
TLSH T1DD055A1AB2D7143BC03606BD492792645C3B7D202A96584B5EFCBF4C1F392A33D36E96
dhash icon 79f896d4ac99d0c2
Reporter Anonymous
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
EVOLUTION TRADE Sp. Zoo. (OFERTA 092127).exe
Verdict:
Malicious activity
Analysis date:
2021-09-28 08:45:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c39dc2ac-c144-4124-88c8-47d22ec55a43

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Renamer
Create hunting rule
Link:
https://www.capesandbox.com/analysis/192467/
Detection(s):
PUA.Win.Malware.Speedingupmypc-6718419-0
Create hunting rule

Win.Virus.Tainp-1
Create hunting rule

Win.Malware.Cbgy-9839050-0
Create hunting rule

Win.Malware.Cbgz-6743174-0
Create hunting rule

Win.Malware.Auopnspi-6887872-0
Create hunting rule

Win.Trojan.Agent-1372183
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Replacing executable files
Creating a file
Deleting a recently created file
Moving a system file
Replacing system executable files
Creating a file in the Windows directory
Replacing system files
Replacing files
Creating a file in the Windows subdirectories
Creating a file in the system32 subdirectories
Creating a file in the system32 directory
Moving a recently created file
Enabling autorun by creating a file
Infecting executable files
Malware family:
Gorgon Group
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bb2f6c6e-ff3f-42d7-87cf-733a9b5b906a
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spre
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/860417
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Infects executable files (exe, dll, sys, html)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/419dfd4197486fb8219fd61895008efbfe8b628f96865dec3bbd054eb900bf13/
Threat name:
Win32.Virus.Grenam
Create hunting rule
Status:
Malicious
First seen:
2021-09-28 08:46:15 UTC
AV detection:
43 of 45 (95.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=igo72qmxjbx3qim72ymjkaeo7p7iwyups2df33b3xucu5oiax4jq._file
Verdict:
malicious
Similar samples:
1f247163023db8b4c9ab82b36befc81bbbd58483bc6d00fafcac9a3a34c9a97d
61b36c03b131bf1dac4d6ddf392b9ebd48a0d6c723abb9119c308dd22b5432db
68f58a48d09d07cd851a8d03cef1a6000f715257fbfbad215e22013ac7a7e611
70f97bf2b133dc63570ac73c9cd3ad0c28991c48254273ccfa40caa17acc01c2
97a6b33da5bd1caba8bf16c1a6457bda8b50ccc25d154962e53d437a8c35661f
a115e321c5902daa72854362422ea2a6cafbc5c7fcadfad0b8d03944d14e32e8
b6177b19a010725f003f7828862f9217af33f3b38a517a40c94c7e8174a91c95
b92e82e83c4f3ea90cd3c64b3276265aee5bfc9acdca956f6df4811b252bb978
cc048d64fe045f9717b0d7f581936d97eac1bdb8af195d08106dca3b48329b34
d8631f817cb56ca5cf3770d7533e5c678e97ff462949370b3042817b1a48111b
+ 34 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/210928-kpb3jabcem/
Behaviour
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Drops autorun.inf file
Drops startup file
Loads dropped DLL
Unpacked files
SH256 hash:
419dfd4197486fb8219fd61895008efbfe8b628f96865dec3bbd054eb900bf13
MD5 hash:
014f151532a5e0fd0f9f6675709517af
SHA1 hash:
a82cdf3dbd7f48aac025a694a0ea95af2a8fd7d2
Link:
https://www.unpac.me/results/68e8a5ba-d0ec-4303-a9aa-fc890f35d740/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/419dfd419748/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/419dfd4197486fb8219fd61895008efbfe8b628f96865dec3bbd054eb900bf13

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Renamer
Create hunting rule
Author:ditekSHen
Description:Detects Renamer/Tainp variants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/192467/

Comments