MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43e79df88e86f344180041d4a4c9381cc69a8ddb46315afd5c4c3ad9e6268e17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43e79df88e86f344180041d4a4c9381cc69a8ddb46315afd5c4c3ad9e6268e17
SHA3-384 hash: c9286f9211cba357cb77394e048490f9fcc08079f1aad5c4bbf85dee71cda1af60633099dd6f812fb777049b677601a6
SHA1 hash: f3c32dfaa1bd4eea360d8c25abc4b8e50049ac49
MD5 hash: 7ac5f00f2307a1f4ef9463be20fb04ea
humanhash: low-shade-ten-oxygen
File name:3rd.dll
Download: download sample
File size:13'840 bytes
First seen:2023-05-20 15:30:04 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 384:1b3TJbNAIIS9aAUW4444GPxsmW4444GPxsh08yLj9CSxtGfnQ433:1bjJbNAIIMaAUW4444GPxsmW4444GPx+
Threatray 122 similar samples on MalwareBazaar
TLSH T16B52F71CF7C539BAF0BA0F7A99D2A14A43A9F9444613EB6F05CD81AA3F4334049D16F1
TrID 87.2% (.DLL) Generic .NET DLL/Assembly (236632/4/32)
3.8% (.EXE) Win64 Executable (generic) (10523/12/4)
2.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.6% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter 0xToxin
Tags:dll KrakenKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
246
Origin country :
IL IL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Tedy.288029.18419.20410.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/6468e7b767e668e8e7fc444e/reports/b260ec63-1c22-4903-a5c0-9ed238af075f/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/43e79df88e86f344180041d4a4c9381cc69a8ddb46315afd5c4c3ad9e6268e17
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/55766194-d707-4484-96a9-a2f82184818f
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1238076
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 871069 Sample: 3rd.dll Startdate: 20/05/2023 Architecture: WINDOWS Score: 52 15 Multi AV Scanner detection for submitted file 2->15 17 Machine Learning detection for sample 2->17 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        process5 13 rundll32.exe 9->13         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/43e79df88e86f344180041d4a4c9381cc69a8ddb46315afd5c4c3ad9e6268e17/
Threat name:
Win32.Trojan.Tedy
Create hunting rule
Status:
Malicious
First seen:
2023-05-20 15:31:05 UTC
File Type:
PE (.Net Dll)
AV detection:
10 of 37 (27.03%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iptz36eoq3zuigaaihkkjsjydtdjvdo3iyyvv7k4jq5ntzrgrylq._file
Verdict:
malicious
Similar samples:
2cda5de71f3a8dd9308515600f7ea4cd6f6bb98d75c59e29839a4b39530bfbbe
3c767a0ad593b2c41a646cec0f17e12363e72ef2697eda72ae96313f899b9438
465ae47eaddb30a5c73bc629399fa34845f1ba18a8fc9e5a55765064b2910b37
81c086e249101b2f7f623296738543eff2d419aed16713c522be56fdeb4f2ca1
8a6bebf08f6c223ed9821ee3b80e420060c66770402687f5c98555f9b0cd02a3
8f6cef21db20e718c2a31bc02aebe81d1fe050e3bb7d6fc69855e6685897e9cd
d583e836532465abed3cb8e846456dd434981306430d1d0a5b21df82c912dcbc
dabc51f754d18831689fcc7a554459a2ca2f023b40ef126e6cd721c225a75249
ece59fc5b87ad5dc5fa299c45ce956d546379e746f91a95b998ba81bca700de1
+ 112 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230520-sx2l6aff8v/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
43e79df88e86f344180041d4a4c9381cc69a8ddb46315afd5c4c3ad9e6268e17
MD5 hash:
7ac5f00f2307a1f4ef9463be20fb04ea
SHA1 hash:
f3c32dfaa1bd4eea360d8c25abc4b8e50049ac49
Link:
https://www.unpac.me/results/31852330-14e3-46b8-89ee-608cc3dd66e8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/43e79df88e86f344180041d4a4c9381cc69a8ddb46315afd5c4c3ad9e6268e17

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments