MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41d1addb382678e81ab59cb80613f2c2ee746b2615233674cc8c323a9a0eff4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41d1addb382678e81ab59cb80613f2c2ee746b2615233674cc8c323a9a0eff4c
SHA3-384 hash: 16b7686072784f3226acd843010878fbe240c180e2499101dc8e79b60853c93b0e45d13d5a02d9320371aa76a0430d66
SHA1 hash: c3500ef4564a6f9db708642890e38a401915759d
MD5 hash: 78859832e79c6d7aedad2de7612b375c
humanhash: item-pennsylvania-oklahoma-kansas
File name:78859832e79c6d7aedad2de7612b375c.exe
Download: download sample
File size:2'611'424 bytes
First seen:2021-04-12 08:01:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ba4cc0afb12afe0a3f885ae6696404ed (1 x ArkeiStealer)
ssdeep 49152:ug8rPO37fzH4A6hanqNmmH0NUF9wZdmD:P8rPO37fzH4A6h0Xiad
Threatray 844 similar samples on MalwareBazaar
TLSH ABC58C29B1B34CB6F36A5E36581641A0673EFD843E28ACD635D6FA3E0BF514335261C2
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
78859832e79c6d7aedad2de7612b375c.exe
Verdict:
Suspicious activity
Analysis date:
2021-04-12 08:05:39 UTC
Tags:
installer
Link:
https://app.any.run/tasks/2c560196-5097-4929-bc70-6ed61f027dd7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/133693/
Detection(s):
Win.Trojan.Gencbl-9848074-0
Create hunting rule

PUA.Win.Packer.PrivateEXEProtector4-6192998-2
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Sending a custom TCP request
DNS request
Sending a UDP request
Sending a TCP request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/672728
Signature
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file has nameless sections
Performs DNS queries to domains with low reputation
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41d1addb382678e81ab59cb80613f2c2ee746b2615233674cc8c323a9a0eff4c/
Threat name:
Win32.Trojan.GenCBL
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 15:38:12 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
1688a5d18382601fb6cc692f38d748d80662ef99609062d4a34236d1f15bc58f
2793bbaba9d12a4a740b6c957143367ce1fb13bb98ecb122e2cb41728bed525e
4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2
5dc4c9f9b91f1d349aa12569b1c9e792710adbc5d8e200b89f92c920008901fc
6cb53f11cd0977599235f756ad6883050db78dab6936da5113729a61cd93036c
7c84f12d1931043664fde0954a5af1b0e30edd8f7fcc6b33cfe298fc431baa84
8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047
af7e5864c9e4b6c0161231a1be5822505ba84eb55e0185693ef5835954c98a21
c366a12ebce6fac89542bd70335a3ad9b0c44692946c6d173234a7840f846812
cf76d84527415e188f5954b3c7289ad60f3b36ad0aedb913c53cf398243609a9
+ 834 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210412-9lblsp98cx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
c45fc45de6b876f8157308a1541807e99eaed698ee6ce6d3081a1d2969171ab7
MD5 hash:
caa1090ef1e650ecb01ca333ac7ea968
SHA1 hash:
6ed3a763a486cc81a5d288fcf94808d9b342d092
Link:
https://www.unpac.me/results/9f10bb2d-a619-423a-9a65-eacab8957eff/
SH256 hash:
41d1addb382678e81ab59cb80613f2c2ee746b2615233674cc8c323a9a0eff4c
MD5 hash:
78859832e79c6d7aedad2de7612b375c
SHA1 hash:
c3500ef4564a6f9db708642890e38a401915759d
Link:
https://www.unpac.me/results/9f10bb2d-a619-423a-9a65-eacab8957eff/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41d1addb382678e81ab59cb80613f2c2ee746b2615233674cc8c323a9a0eff4c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_7d36cbb64bc9add17ba71737d3ecceca
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 41d1addb382678e81ab59cb80613f2c2ee746b2615233674cc8c323a9a0eff4c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1107056/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1107069/
Cape
Cape
https://www.capesandbox.com/analysis/133693/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-14 17:38:54 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
1) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
2) [F0002.002] Collection::Polling
4) [C0003.001] Communication Micro-objective::Create Pipe::Interprocess Communication
5) [C0003.003] Communication Micro-objective::Read Pipe::Interprocess Communication
6) [C0003.004] Communication Micro-objective::Write Pipe::Interprocess Communication
7) [C0029.002] Cryptography Micro-objective::SHA1::Cryptographic Hash
8) [C0021] Cryptography Micro-objective::Generate Pseudo-random Sequence
9) [C0032.001] Data Micro-objective::CRC32::Checksum
10) [C0026.002] Data Micro-objective::XOR::Encode Data
12) [B0023] Execution::Install Additional Program
13) [C0045] File System Micro-objective::Copy File
14) [C0046] File System Micro-objective::Create Directory
15) [C0048] File System Micro-objective::Delete Directory
16) [C0047] File System Micro-objective::Delete File
17) [C0049] File System Micro-objective::Get File Attributes
18) [C0051] File System Micro-objective::Read File
19) [C0050] File System Micro-objective::Set File Attributes
20) [C0052] File System Micro-objective::Writes File
21) [C0007] Memory Micro-objective::Allocate Memory
22) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
23) [C0036.002] Operating System Micro-objective::Delete Registry Key::Registry
24) [C0036.007] Operating System Micro-objective::Delete Registry Value::Registry
25) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
26) [C0036.005] Operating System Micro-objective::Query Registry Key::Registry
27) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
28) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
29) [C0043] Process Micro-objective::Check Mutex
30) [C0042] Process Micro-objective::Create Mutex
31) [C0017.003] Process Micro-objective::Create Suspended Process::Create Process
32) [C0017] Process Micro-objective::Create Process
33) [C0038] Process Micro-objective::Create Thread
34) [C0041] Process Micro-objective::Set Thread Local Storage Value
35) [C0018] Process Micro-objective::Terminate Process
36) [C0039] Process Micro-objective::Terminate Thread