MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45c9ec792bbb263ad7f58e1077dbee321115764abfbf9f26686fada2a17b6c4b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Hive

Vendor detections: 8

Intelligence 8 IOCs YARA 6 File information Comments 1

SHA256 hash:	45c9ec792bbb263ad7f58e1077dbee321115764abfbf9f26686fada2a17b6c4b
SHA3-384 hash:	4f6d4a0714a4e744b1fabcbbac6d4ac92ddf893369a7d7519ec8599eebec403214a47b2218b5f1c5c689a865e92643cd
SHA1 hash:	2868de40ff45ad4384ad0b15f03446fc42884b4a
MD5 hash:	2bc8de3399fb0c834d19fbbc486aeb36
humanhash:	muppet-social-maine-william
File name:	2bc8de3399fb0c834d19fbbc486aeb36
Download:	download sample
Signature	Hive Create hunting rule
File size:	7'507'456 bytes
First seen:	2022-01-23 16:37:05 UTC
Last seen:	2022-01-23 19:01:20 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e6efb84c997b145566619aa9dc9a7eef (6 x Hive, 1 x AsyncRAT, 1 x RedLineStealer)
ssdeep	98304:grMetWMtxMk2HMVlMs4o+uEIjMEAU5LwbB5Q:1yWdMI2jlV5a5
Threatray	16 similar samples on MalwareBazaar
TLSH	T1ED764A03F99155E8C1AEC2708766D262BB71B4C8073167D72B60DBB12F17BD4AEB9318
Reporter	zbetcheckin
Tags:	exe Hive

Intelligence

File Origin

# of uploads :

# of downloads :

303

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/221722/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.48037609.13507.846.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

DNS request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/61ed846e0f8c757253de51e1/reports/9fba1078-4382-4828-a2c1-3c135ef1cb41/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/dddd41dd-7b5e-4283-944e-29f69634254f

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/925867

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/45c9ec792bbb263ad7f58e1077dbee321115764abfbf9f26686fada2a17b6c4b/

Threat name:

Win64.Infostealer.BroPass

Status:

Malicious

First seen:

2022-01-22 00:06:00 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

21 of 28 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ixe6y6jlxmtdvv7vryihpw7ogiirk5skx67z6jtin6w2fil3nrfq._file

Verdict:

malicious

Hive

47e9b75457446a3b3c86622dd282065b0f88603e2c009670c1f7eaf00183a407

Hive

54bcd3308c140c8ec030f98697cc7f0e9d4585d54334a2eb77c58879510d5c8c

Hive

6104f2b4049168fea236bb6a5b9a5194b878b61f87336eafb0fe5a5fab93144b

Hive

67e030c1c7dd08138eb1d6a12a4d652c4a304f22db556afce411c32a23bddf23

Hive

7d8de08a564f08ee20d746a2c445245b75247e772248073431fc30d16a4b9b14

Hive

a206d34bbfb7274775956f308ae81339a673c0e894ed55ee1e8e0f01f20ba5fb

Hive

ca0abe0d1554af3cbfcf5ee2a0dd00820a0dcb7397ea7add4c2c5334baac9086

Hive

fde5ae51e9d386cb7a78da447c48101a50f543faffd5a9929451249bcce654c8

Hive

+ 6 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/220123-t5dqqsgbdr/

Behaviour

Suspicious behavior: EnumeratesProcesses

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

45c9ec792bbb263ad7f58e1077dbee321115764abfbf9f26686fada2a17b6c4b

MD5 hash:

2bc8de3399fb0c834d19fbbc486aeb36

SHA1 hash:

2868de40ff45ad4384ad0b15f03446fc42884b4a

Link:

https://www.unpac.me/results/f1ae1a17-3c5d-4398-a3d6-dc4a825152c5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/45c9ec792bbb263ad7f58e1077dbee321115764abfbf9f26686fada2a17b6c4b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	Golangmalware Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang

Rule name:	HiveRansomware Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	INDICATOR_SUSPICIOUS_References_SecTools Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many IR and analysis tools