MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4296080a2384f70638c544c1a4d598035cb895e7346080960df2413510e0c04a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4296080a2384f70638c544c1a4d598035cb895e7346080960df2413510e0c04a
SHA3-384 hash: 884dbf3bc03ac63f4d1ddd853d3c6b50b50f49e7d74cbd9f1d53667eb87c9c8a7576186d425b0d1641b924618ff419cf
SHA1 hash: 0a041109b4312e2caff26bde09e6516068f2d859
MD5 hash: b84dc7b0bc920d1bf39104f70af0f43e
humanhash: magnesium-montana-steak-washington
File name:Aplicativo seguro Windows.msi
Download: download sample
File size:22'074'368 bytes
First seen:2022-11-03 15:16:50 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 393216:DoB4NduuttsPpvyrDQBNhnV50AuuypFuflMY4KwFvcPHbwZTzDhu4Ro6OpRgJn6:DUqMuttsPpvkgDnV5xVypFuflIFvG78G
Threatray 18 similar samples on MalwareBazaar
TLSH T19D270321D37778D9EA2762BFE0AC5FC48010BDF1A118E66B73783FB589A054621F6943
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter johnk3r
Tags:banker msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
shell32.dll
Link:
https://www.filescan.io/uploads/6363dfe596e7fbdce59016e4/reports/4e8ca810-1010-455d-831b-322cbabf52ab/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/4296080a2384f70638c544c1a4d598035cb895e7346080960df2413510e0c04a
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1104515
Signature
Multi AV Scanner detection for dropped file
PE file contains section with special chars
Behaviour
Behavior Graph:
Download SVG
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iklaqcrdqt3qmogfita2jvmyanolrfphgrqibfqn6jatkehaybfa._file
Verdict:
unknown
Similar samples:
0cf728a105d41d01c1895e126253343b63c30b720700b195c54bec21e109fbe1
18e57acc198a3afad96f6fff17a0cc538da02afcba38036dda6cf1b8902efd2b
27b5e52c0c575a9d1a1e460ee54fc4f411fd5783b886854d332253c4ff80c51e
4f6cb888a4dfade727490683feaee96679d7044f0181799c18a8c7060cb8dab3
58566c99891689f9eb1a7cf36e7dc9cb0692c231e2eb299787e21175d6241b92
7321a205de31cb4c93f10a090316502922d9083dfc076c93903377f36ada3aca
ce41f7c712e0113700f0f3653868200af041f3e170f45dacc6d6e3542ab91062
ffb318a5fd569396377f80259fb3b2ff02ef492efa1922ccbdd1bcdf1f43c162
+ 8 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/221103-sn2wkaeaep/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Enumerates connected drives
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/4296080a2384f70638c544c1a4d598035cb895e7346080960df2413510e0c04a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments