🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47e9917ce0afc96632db5e95db2fd9aff10d05b0399fd05d02035eacb3c1f399. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47e9917ce0afc96632db5e95db2fd9aff10d05b0399fd05d02035eacb3c1f399
SHA3-384 hash: 07afcdbcaedc60e0ae0f2c454b7718e855e51a63b3d93a957addc56e77fe16a674644e5541417cc30c3ad5b708efd655
SHA1 hash: 7a58fc9a14a7c4c0abaa8d9bae5d69e74a19762d
MD5 hash: f5fca1b178af87bd48c7ea9e3f2c957b
humanhash: oklahoma-nuts-illinois-venus
File name:f5fca1b178af87bd48c7ea9e3f2c957b
Download: download sample
File size:33'126 bytes
First seen:2024-05-12 15:24:48 UTC
Last seen:2025-02-07 16:03:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 384:wnlkJzAQeFTaSO1CoRWQDwyErOfeYVTDj95Ssz95:wnlRbFm5AoR3XVTDj955z95
TLSH T18CE2092313EDA1E8E6FA827EC42A1923D57674462332F9FF13A046AD2F11D85653DB03
TrID 50.0% (.EXE) Generic Win/DOS Executable (2002/3)
49.9% (.EXE) DOS Executable Generic (2000/1)
Reporter zbetcheckin
Tags:64 exe IcedID imitrex24-com same Latrodectus C2

Intelligence

File Origin
# of uploads :
2
# of downloads :
609
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
icedid
Create hunting rule
ID:
1
File name:
47e9917ce0afc96632db5e95db2fd9aff10d05b0399fd05d02035eacb3c1f399.exe
Verdict:
Malicious activity
Analysis date:
2024-05-12 15:27:34 UTC
Tags:
evasion icedid
Link:
https://app.any.run/tasks/30b74c5a-851b-4d01-81d0-eb5a6541ac6d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win64.TrojanX-gen.10.13684.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Launching cmd.exe command interpreter
Creating a process with a hidden window
Launching a process
Forced system process termination
Using the Windows Management Instrumentation requests
Launching the process to interact with network services
Verdict:
Malicious
Labled as:
ShellCode.PE.Marte.2.Generic
Link:
https://www.hybrid-analysis.com/sample/47e9917ce0afc96632db5e95db2fd9aff10d05b0399fd05d02035eacb3c1f399
Malware family:
IcedID
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9d4b5d96-3bc1-4108-a12d-c33fd2c26b43
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1440192
Signature
Contains functionality to spread via wmic.exe
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Performs a network lookup / discovery via net view
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Uses ipconfig to lookup or modify the Windows network settings
Uses net.exe to modify the status of services
Uses whoami command line tool to query computer and username
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1440192 Sample: uJ5c4dQ44E.exe Startdate: 12/05/2024 Architecture: WINDOWS Score: 80 47 ifconfig.me 2->47 51 Multi AV Scanner detection for submitted file 2->51 53 Machine Learning detection for sample 2->53 55 Sigma detected: Rare Remote Thread Creation By Uncommon Source Image 2->55 9 uJ5c4dQ44E.exe 12 2->9         started        signatures3 process4 dnsIp5 49 ifconfig.me 34.117.118.44, 443, 49730 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 9->49 57 Contains functionality to spread via wmic.exe 9->57 13 cmd.exe 1 9->13         started        16 cmd.exe 1 9->16         started        18 cmd.exe 1 9->18         started        20 8 other processes 9->20 signatures6 process7 signatures8 61 Uses net.exe to modify the status of services 13->61 63 Uses ipconfig to lookup or modify the Windows network settings 13->63 65 Uses whoami command line tool to query computer and username 13->65 22 conhost.exe 13->22         started        24 ipconfig.exe 1 13->24         started        26 systeminfo.exe 2 1 16->26         started        29 conhost.exe 16->29         started        67 Performs a network lookup / discovery via net view 18->67 37 2 other processes 18->37 31 net.exe 1 20->31         started        33 net.exe 1 20->33         started        35 WMIC.exe 1 20->35         started        39 13 other processes 20->39 process9 signatures10 59 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 26->59 41 WmiPrvSE.exe 26->41         started        43 net1.exe 1 31->43         started        45 net1.exe 1 33->45         started        process11
Score:
61%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/47e9917ce0afc96632db5e95db2fd9aff10d05b0399fd05d02035eacb3c1f399
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47e9917ce0afc96632db5e95db2fd9aff10d05b0399fd05d02035eacb3c1f399/
Threat name:
Win64.Exploit.Marte
Create hunting rule
Status:
Malicious
First seen:
2024-05-12 15:25:07 UTC
File Type:
PE+ (Exe)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i7uzc7hav7ewmmw3l2k5wl6zv7yq2bnqhgp5axicanpkzm6b6omq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/240512-stlfrscb7x/
Behaviour
Discovers systems in the same network
Gathers network information
Gathers system information
Modifies system certificate store
Runs net.exe
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Unpacked files
SH256 hash:
47e9917ce0afc96632db5e95db2fd9aff10d05b0399fd05d02035eacb3c1f399
MD5 hash:
f5fca1b178af87bd48c7ea9e3f2c957b
SHA1 hash:
7a58fc9a14a7c4c0abaa8d9bae5d69e74a19762d
Link:
https://www.unpac.me/results/8b4a4d75-3235-4b1b-bb04-f76d5da8620b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/47e9917ce0afc96632db5e95db2fd9aff10d05b0399fd05d02035eacb3c1f399

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 47e9917ce0afc96632db5e95db2fd9aff10d05b0399fd05d02035eacb3c1f399

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2847836/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments


Avatar
zbet commented on 2024-05-12 15:24:49 UTC

url : hxxps://workspacin.cloud/files/sysinfo.bin