MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 454d76ef9b357985c651a1c636cd7a07c680c4e42e2856e54659fb38d5e2532c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 454d76ef9b357985c651a1c636cd7a07c680c4e42e2856e54659fb38d5e2532c
SHA3-384 hash: 6e09fc2604b691b3688907efc67e7797cc8b376cad12ea9aee9453cca9ecaf407c1c79c6bc44ebe86721ed2e7f221f92
SHA1 hash: 1b40d5d636ccd9f4c63d27d17c1859355a8aea7e
MD5 hash: d9583d0837c3e9a8660bd7c0c872a19f
humanhash: seventeen-lamp-stairway-mountain
File name:ClassLibrary1.dll
Download: download sample
File size:32'256 bytes
First seen:2021-08-29 06:18:52 UTC
Last seen:2021-08-29 07:07:48 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 768:Wl5fL0j+ldt+kNvnKYXlx/cBh5xmuRhhvd:a0j+lukNyoihN
Threatray 143 similar samples on MalwareBazaar
TLSH T150E2E81B52CE7DE2C4B82631777303C0C72CDE05C893EA2E4AD9B969997E24779523D8
dhash icon 414545c0d4c05503 (37 x njrat, 3 x AsyncRAT, 1 x RedLineStealer)
Reporter JAMESWT_WT
Tags:dll

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/183192/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.15977.19313.6622.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/8ac4c246-aef6-4b74-b78c-d77aceef7756
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/840952
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 473383 Sample: ClassLibrary1.dll Startdate: 29/08/2021 Architecture: WINDOWS Score: 48 13 Multi AV Scanner detection for submitted file 2->13 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        process5 11 rundll32.exe 9->11         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/454d76ef9b357985c651a1c636cd7a07c680c4e42e2856e54659fb38d5e2532c/
Threat name:
Win32.Trojan.InjectorX
Create hunting rule
Status:
Malicious
First seen:
2021-08-23 07:52:08 UTC
File Type:
PE (.Net Dll)
Extracted files:
13
AV detection:
11 of 45 (24.44%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
048cc9b5192aaf602f1c1cb21caf8b5c8e96b8f51f32ff010dbc7e669d5f856d
10a30b9776bb8981976fe678e4538e68c8fbbb0a57f34934978b3df7238be8d5
14eb1e82e99353e4e4fb35444b82e3af528ea1193e921b14f8ebdba6e457f0ef
3e065cb08c3849a2eefd0ac3037f47aa958e106179976c11fbeec34a6f0593d2
4e0d95ed4e6390e06c4dd40425dcd4988c74effd08a7ed0ae577491ac3e3c655
a7f68c540c7f610ce1127b997f3097815b0dbbdb6dd9a7d4637f4059a7af26f4
c1911013a12f40b0a1f344eec88f2fba5a5f505335feec6c0a54a6e23cb66564
d6b1f8c5ddef7568c1985b99db389b4671d6cf3a4004866d93620553da133992
dc8a2332c245f1019a3c08c53f649f0bf1ea42fad18c90fea68ac4aa1eb387aa
e73a75a27e10ebb5efaa129b0d8163ea8e2d1ba544d297ba7259dcf6019b4ca3
+ 133 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210829-639w79q9ma/
Unpacked files
SH256 hash:
454d76ef9b357985c651a1c636cd7a07c680c4e42e2856e54659fb38d5e2532c
MD5 hash:
d9583d0837c3e9a8660bd7c0c872a19f
SHA1 hash:
1b40d5d636ccd9f4c63d27d17c1859355a8aea7e
Link:
https://www.unpac.me/results/05ad7f51-2bc9-4b09-91fb-66372e5aa76e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/454d76ef9b357985c651a1c636cd7a07c680c4e42e2856e54659fb38d5e2532c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DLL dll 454d76ef9b357985c651a1c636cd7a07c680c4e42e2856e54659fb38d5e2532c

(this sample)

  
X
https://twitter.com/StopMalvertisin/status/1431571125306232838?s=20
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1574191/
Cape
Cape
https://www.capesandbox.com/analysis/183192/

Comments