MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44dc55275444f583d81f224be2172d1468ca7901032329ad2210a3b7abfaf80e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44dc55275444f583d81f224be2172d1468ca7901032329ad2210a3b7abfaf80e
SHA3-384 hash: 985d48cdb658588b99e0d868fb928519b14c5a65946a73f494b5f5e7382ef430d3e6e016cb16fc6c097d1ea9790722b9
SHA1 hash: e5646eb3802f387e12cdc09d7a5e89ff1b913501
MD5 hash: 6c92d9810a4ddd0466cca874b515c178
humanhash: mirror-illinois-low-maine
File name:44dc55275444f583d81f224be2172d1468ca7901032329ad2210a3b7abfaf80e.exe
Download: download sample
File size:1'122'695 bytes
First seen:2022-06-02 10:51:53 UTC
Last seen:2022-06-02 11:48:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e037327a20e5c7520a608e1a32477275
ssdeep 24576:0gRwE/cKJVuCNsnCdIDMNMnNOlAF1ysqYUQp8i/QWDzC6uo:9+0cauCNsnCd/Ntlmy5YUQp8cQYF
TLSH T1A93533143FA340C9ED352DF42E79A69DF340A0552E1109D3D3611E52FE7B8DE8B8A58E
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter MWerken
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
317
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
44dc55275444f583d81f224be2172d1468ca7901032329ad2210a3b7abfaf80e.exe
Verdict:
No threats detected
Analysis date:
2022-06-02 11:03:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0f9195e5-7257-4bdf-bcc3-6af5374433d0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/276302/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.23645.32090.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Creating a window
Creating a file in the Program Files subdirectories
Searching for synchronization primitives
Searching for the Windows task manager window
Creating a process from a recently created file
Creating a process with a hidden window
Creating a service
Launching a service
Launching the default Windows debugger (dwwin.exe)
Launching a process
Modifying a system file
Enabling autorun for a service
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
buer control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/629896658787703a222be84a/reports/1e923353-8d40-4e8d-96e6-896c7cd15525/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/fcd9adb5-998e-46c8-86e7-c3ea4c70c010
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
evad
Score:
36 / 100
Link:
https://www.joesandbox.com/analysis/1005652
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 process2 2 Behavior Graph ID: 638146 Sample: N1tqNepxuU.exe Startdate: 02/06/2022 Architecture: WINDOWS Score: 36 6 svchost.exe 2->6         started        9 N1tqNepxuU.exe 19 31 2->9         started        12 svchost.exe 1 1 2->12         started        15 11 other processes 2->15 dnsIp3 43 Changes security center settings (notifications, updates, antivirus, firewall) 6->43 17 MpCmdRun.exe 1 6->17         started        31 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 9->31 dropped 33 C:\Users\user\AppData\Local\...\System.dll, PE32 9->33 dropped 35 C:\...\RzChromaStreamPlugin64.dll, PE32+ 9->35 dropped 37 4 other files (none is malicious) 9->37 dropped 19 RzChromaStreamServer.exe 9->19         started        21 RzChromaStreamServer.exe 9->21         started        39 127.0.0.1 unknown unknown 12->39 41 192.168.2.1 unknown unknown 12->41 23 WerFault.exe 23 15 15->23         started        25 WerFault.exe 11 15->25         started        27 WerFault.exe 15->27         started        file4 signatures5 process6 process7 29 conhost.exe 17->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44dc55275444f583d81f224be2172d1468ca7901032329ad2210a3b7abfaf80e/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=itofkj2uit2yhwa7ejf6efzncrumu6ibamrstljcccr3pk727aha._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/220602-mydzlafca5/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
3bff9859aa88fe0afa17dd85739f9ad345c2ea2a9187812c9bcc8f4848dfbf66
MD5 hash:
91fe5ced092c5281fe484ecb9c97abcb
SHA1 hash:
c7ca2f80429648dddc9d3f2388906e09e36e5724
Link:
https://www.unpac.me/results/90e7f696-9248-41c9-866a-531119216a13/
SH256 hash:
307f9f396534f52be5edad5aa2d7d324b8ca6407f4b5d3fddc5cc246d7bc6582
MD5 hash:
c8fd60072a33dd8e5cac9294dde62aa2
SHA1 hash:
86ffc46fb0ac1adb9b720334e1e22d5c214e2670
Link:
https://www.unpac.me/results/90e7f696-9248-41c9-866a-531119216a13/
SH256 hash:
e7b145abc7c519e6bd91dc06b7b83d1e73735ac1ac37d30a7889840a6eed38fc
MD5 hash:
50ba20cad29399e2db9fa75a1324bd1d
SHA1 hash:
3850634bb15a112623222972ef554c8d1eca16f4
Detections:
win_flawedammyy_auto
Create hunting rule
Link:
https://www.unpac.me/results/90e7f696-9248-41c9-866a-531119216a13/
Parent samples :
44dc55275444f583d81f224be2172d1468ca7901032329ad2210a3b7abfaf80e
b3a1509f77da1f09f79e2d0d6b6c6938db01f8ec67fa6adcf992eeb5b6b8698a
6a3648d9ef381db17f71b6e13ed8006fd12069183e2824b455a170afc64fa0ba
7b7c066f031d5021b3ce30236a545cfea9736fded345e10d3380dd5c89447417
145c299180fb1556c843a944b33f57c933382c801906a9b7ce3f59f7028b0409
SH256 hash:
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 hash:
fbe295e5a1acfbd0a6271898f885fe6a
SHA1 hash:
d6d205922e61635472efb13c2bb92c9ac6cb96da
Link:
https://www.unpac.me/results/90e7f696-9248-41c9-866a-531119216a13/
SH256 hash:
4bf14031eb0460e4e8234ef1157d8a254354504ced37f86fdbb1644ed45302c0
MD5 hash:
a4e21a6c9cde2319a1d2dc7335229e47
SHA1 hash:
141082e43fd1bbe6e5ac022dd4074b6c9e7a23d4
Detections:
win_flawedammyy_auto
Create hunting rule
Link:
https://www.unpac.me/results/90e7f696-9248-41c9-866a-531119216a13/
Parent samples :
44dc55275444f583d81f224be2172d1468ca7901032329ad2210a3b7abfaf80e
b3a1509f77da1f09f79e2d0d6b6c6938db01f8ec67fa6adcf992eeb5b6b8698a
6a3648d9ef381db17f71b6e13ed8006fd12069183e2824b455a170afc64fa0ba
7b7c066f031d5021b3ce30236a545cfea9736fded345e10d3380dd5c89447417
145c299180fb1556c843a944b33f57c933382c801906a9b7ce3f59f7028b0409
SH256 hash:
44dc55275444f583d81f224be2172d1468ca7901032329ad2210a3b7abfaf80e
MD5 hash:
6c92d9810a4ddd0466cca874b515c178
SHA1 hash:
e5646eb3802f387e12cdc09d7a5e89ff1b913501
Link:
https://www.unpac.me/results/90e7f696-9248-41c9-866a-531119216a13/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.48
Link:
https://yomi.yoroi.company/submissions/44dc55275444f583d81f224be2172d1468ca7901032329ad2210a3b7abfaf80e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/276302/

Comments