MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 42f76f37742103bd599a68ef508b515efeb9e9ffddbfdcc43eb552b70b2440e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Lazarus
Vendor detections: 8
| SHA256 hash: | 42f76f37742103bd599a68ef508b515efeb9e9ffddbfdcc43eb552b70b2440e9 |
|---|---|
| SHA3-384 hash: | 92a21933647171d95550910c8face3e87c3a9e16d16dda4b232cbf926c4339d62da9b04c06157fd201b5e23b7350ae5d |
| SHA1 hash: | 08a6ff5c2d443d2bf9facb2a458de2876328061b |
| MD5 hash: | 3ef1892c1a5f1bb056871b7d7e5cd69a |
| humanhash: | apart-mockingbird-comet-uranus |
| File name: | Amazon Workspaces.exe |
| Download: | download sample |
| Signature | Lazarus |
| File size: | 3'207'168 bytes |
| First seen: | 2023-05-12 09:20:16 UTC |
| Last seen: | 2023-06-08 08:30:44 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | bb95a3753c15dcb5321833d4a7448423 (1 x Lazarus) |
| ssdeep | 49152:dwG5dutV04/iT5W5pLoJ6qJNPhERaU+d:uGgJNVARX5ERaUc |
| TLSH | T15FE5CF566BB440E4D1B6C13D8AB6D682F7B178950B31CBDF16A1536E2F33AD04D3A322 |
| TrID | 90.1% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 4.8% (.EXE) Win64 Executable (generic) (10523/12/4) 2.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 0.9% (.EXE) OS/2 Executable (generic) (2029/13) 0.9% (.EXE) Generic Win/DOS Executable (2002/3) |
| File icon (PE): |  |
| dhash icon | 08e4c2a0b0b8f060 (1 x Lazarus) |
| Reporter |  JAMESWT_WT |
| Tags: | exe Lazarus |
Intelligence
File Origin
# of uploads :
2
# of downloads :
331
Origin country :
ITVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Amazon Workspaces.exe
Verdict:
Malicious activity
Analysis date:
2023-05-12 09:23:43 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a window
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
No Threat
Threat level:
10/10
Confidence:
100%
Tags:
greyware keylogger
Verdict:
Suspicious
Labled as:
Win64/NukeSped.PI trojan
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
suspicious
Classification:
spyw
Score:
28 / 100
Signature
Contains functionality to modify clipboard data
Behaviour
Behavior Graph:
Threat name:
Win64.Trojan.NukeSped
Status:
Malicious
First seen:
2023-05-12 09:19:58 UTC
File Type:
PE+ (Exe)
Extracted files:
28
AV detection:
13 of 24 (54.17%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Enumerates system info in registry
Suspicious behavior: GetForegroundWindowSpam
Unpacked files
SH256 hash:
42f76f37742103bd599a68ef508b515efeb9e9ffddbfdcc43eb552b70b2440e9
MD5 hash:
3ef1892c1a5f1bb056871b7d7e5cd69a
SHA1 hash:
08a6ff5c2d443d2bf9facb2a458de2876328061b
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.