MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41da684add05801458398e2a45805258ba5a78c77e079f1d8f15aed85a4034e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41da684add05801458398e2a45805258ba5a78c77e079f1d8f15aed85a4034e6
SHA3-384 hash: f1621d778a0ea712c72a5d4ee62447caaa92c84432f5a1a409262e7c4d5c0e014ab2369a251c11c24f12c5fe80aa6b83
SHA1 hash: 8cd7f7fba9a6d0aa893bc8ac633d305996ba8406
MD5 hash: a0e7cf5c61487820e290a71a1a16994a
humanhash: william-artist-one-ceiling
File name:a0e7cf5c61487820e290a71a1a16994a.exe
Download: download sample
File size:258'048 bytes
First seen:2022-11-14 18:45:12 UTC
Last seen:2022-11-14 20:44:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash cddebb8fa6c0a087547241e14a7bb869
ssdeep 6144:+t637+itNwE8LrZDa3Y4RCJOoOkvpbWS1S:+tQ7ezLrZDa3fRCsoJS
TLSH T1C7446BCCB0EA90B9C4370D3ECCF679DD9769A7600A344B2FA77C07781AA414D26916E7
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
175
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a0e7cf5c61487820e290a71a1a16994a.exe
Verdict:
Malicious activity
Analysis date:
2022-11-14 18:46:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/df1b025d-2c31-4101-af66-303a1359aedb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/333888/
Detection(s):
SecuriteInfo.com.Variant.Graftor.372355.17494.26242.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Launching a process
Downloading the file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/52410/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed rat shell32.dll
Link:
https://www.filescan.io/uploads/63728ced65b4ed3de8c844dd/reports/4bfbb1ed-1323-4543-abd1-2f16e5ceaa17/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Nymaim
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/95019a3c-b8a3-4c71-ab49-c3368accbbc4
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1113167
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Sigma detected: Powershell Download and Execute IEX
Uses ping.exe to check the status of other devices and networks
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 745864 Sample: Qf3zCuKHL0.exe Startdate: 14/11/2022 Architecture: WINDOWS Score: 68 31 Multi AV Scanner detection for submitted file 2->31 33 Sigma detected: Powershell Download and Execute IEX 2->33 35 Machine Learning detection for sample 2->35 7 Qf3zCuKHL0.exe 7 2->7         started        process3 dnsIp4 29 fluxportugal.pt 94.46.25.210, 443, 49698, 49699 ALMOUROLTECPT Portugal 7->29 37 Self deletion via cmd or bat file 7->37 11 cmd.exe 1 7->11         started        14 cmd.exe 1 7->14         started        signatures5 process6 signatures7 39 Uses ping.exe to check the status of other devices and networks 11->39 16 PING.EXE 1 11->16         started        19 conhost.exe 11->19         started        21 powershell.exe 14 15 14->21         started        23 conhost.exe 14->23         started        process8 dnsIp9 25 127.0.0.1 unknown unknown 16->25 27 fluxportugal.pt 21->27
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41da684add05801458398e2a45805258ba5a78c77e079f1d8f15aed85a4034e6/
Threat name:
Win32.Trojan.Graftor
Create hunting rule
Status:
Malicious
First seen:
2022-11-14 18:46:09 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
16 of 40 (40.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ihngqsw5awabiwbzryvelacslc5fu6ghpydz6hmpcwxnqwsagtta._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/221114-xend2ahd2t/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Deletes itself
Blocklisted process makes network request
Malware Config
Dropper Extraction:
https://fluxportugal.pt/js/vendor/config_20.ps1
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7750c482-2e25-4d72-aa66-991c7554dac9
Unpacked files
SH256 hash:
41da684add05801458398e2a45805258ba5a78c77e079f1d8f15aed85a4034e6
MD5 hash:
a0e7cf5c61487820e290a71a1a16994a
SHA1 hash:
8cd7f7fba9a6d0aa893bc8ac633d305996ba8406
Link:
https://www.unpac.me/results/dc30de9b-059c-458c-bd95-eb377966c124/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41da684add05801458398e2a45805258ba5a78c77e079f1d8f15aed85a4034e6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 41da684add05801458398e2a45805258ba5a78c77e079f1d8f15aed85a4034e6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2407572/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/333888/

Comments