MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44d34c67280b0e3472b22d6370e09c639df6a5ae997ad147e939161f78fd3243. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Adware.Techsnab

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments 1

SHA256 hash:	44d34c67280b0e3472b22d6370e09c639df6a5ae997ad147e939161f78fd3243
SHA3-384 hash:	94089552e0d79bd344a60faa9d61724a403de684a8887c69ddc0b574cfc04e17e82c730ca03e2db4bccccb6d07214b43
SHA1 hash:	feb64527fec5d72603d590f1b163919440832568
MD5 hash:	e7bb911572a5fd795bc621077c6d0e74
humanhash:	orange-triple-beryllium-crazy
File name:	e7bb911572a5fd795bc621077c6d0e74
Download:	download sample
Signature	Adware.Techsnab Create hunting rule
File size:	5'592'064 bytes
First seen:	2022-08-11 17:34:08 UTC
Last seen:	2022-08-11 18:44:40 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	83925fa3f4a934ff9c738b0db4549d5a (2 x Adware.Techsnab)
ssdeep	49152:XzROAAIH7gXvVKhB50B/NSzwXKERVxdgtJhYk0bMrNChtmIP8CPZ+XTv4YuBqDvY:XUV+g1+hYnyPhbJaz4v+
TLSH	T196468C03F69645EAC0BEC178C6575333E772BC890621B3AB57D49B612E23BA05F2D349
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter	zbetcheckin
Tags:	Adware.Techsnab exe

Intelligence

File Origin

# of uploads :

# of downloads :

446

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

e7bb911572a5fd795bc621077c6d0e74

Verdict:

No threats detected

Analysis date:

2022-08-11 17:35:33 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/a2d8018b-789b-4aaa-b9b6-1ed884b727c3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/298076/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Stealer.34118.27798.21520.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/28721/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm greyware

Link:

https://www.filescan.io/uploads/62f53e40e456f39ac94218df/reports/bbd7c38b-17c6-4d1b-a313-6846c1e8db8e/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2ba05720-2c52-47c4-b561-ab0fd07e91d5

Result

Threat name:

Luca Stealer

Detection:

malicious

Classification:

troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1050129

Signature

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries temperature or sensor information (via WMI often done to detect virtual machines)

Yara detected Luca Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/44d34c67280b0e3472b22d6370e09c639df6a5ae997ad147e939161f78fd3243/

Threat name:

Win64.Infostealer.Disco

Status:

Malicious

First seen:

2022-08-11 08:05:08 UTC

File Type:

PE+ (Exe)

AV detection:

14 of 26 (53.85%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=itjuyzzibmhdi4vsfvrxbye4moo7njnotf5ncr7jhelb66h5gjbq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/220811-v5gytsaccn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

44d34c67280b0e3472b22d6370e09c639df6a5ae997ad147e939161f78fd3243

MD5 hash:

e7bb911572a5fd795bc621077c6d0e74

SHA1 hash:

feb64527fec5d72603d590f1b163919440832568

Link:

https://www.unpac.me/results/52b521ac-a9ab-4cb0-b758-3e9d5f300032/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/44d34c67280b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/44d34c67280b0e3472b22d6370e09c639df6a5ae997ad147e939161f78fd3243

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	adonunix2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	AD on UNIX

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	INDICATOR_SUSPICIOUS_EXE_DiscordURL Create hunting rule
Author:	ditekSHen
Description:	Detects executables Discord URL observed in first stage droppers

Rule name:	Rustyloader_mem_loose Create hunting rule
Author:	James_inthe_box
Description:	Corroded buerloader
Reference:	https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24