MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 486501d84098db21de46860042bb16b15f7e4e4a7aec7ecc89c445947e295dd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 486501d84098db21de46860042bb16b15f7e4e4a7aec7ecc89c445947e295dd9
SHA3-384 hash: 2ef63fb6b813738add40f262c11f308cf77cf75b13e125c720960b22dac7ea6f964bb7cb6c6f89903a68aec14fdd5d53
SHA1 hash: afff3baca43a3c39dd589a34e096706745cf2da3
MD5 hash: ec30b70609bd5542190692d073c1d38d
humanhash: summer-equal-alabama-freddie
File name:The Last of Us Part I update 1.1.0.0 - 1.1.1.0.exe
Download: download sample
File size:4'153'763 bytes
First seen:2023-08-02 17:45:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 48aa5c8931746a9655524f67b25a47ef (4 x Adware.Generic, 3 x AsyncRAT, 3 x Vidar)
ssdeep 98304:Q1xcPAX7C+m/FsujkSdQ/mtQTIaSYvX8Twk+VCg:lPVH/oS0NSY14g
Threatray 3 similar samples on MalwareBazaar
TLSH T184163300B7D36C3CF2631CB88A619414BEB67EE904FA4051DF39DE1F81B5ADAA875523
TrID 38.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
28.2% (.EXE) Win64 Executable (generic) (10523/12/4)
12.0% (.EXE) Win32 Executable (generic) (4505/5/1)
5.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
5.4% (.EXE) OS/2 Executable (generic) (2029/13)
dhash icon 981e0b8bc781cdcd
Reporter Ruiz2001
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
289
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
The Last of Us Part I update 1.1.0.0 - 1.1.1.0.exe
Verdict:
No threats detected
Analysis date:
2023-08-02 17:46:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/58771e6d-4c95-481b-bb1a-7b760cdd487a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/439899/
Detection(s):
PUA.Win.Malware.Speedingupmypc-6718419-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control installer lolbin masquerade overlay packed shell32
Link:
https://www.filescan.io/uploads/64ca965fc7115fded3683f93/reports/8f6fc105-560f-43d3-b433-88143800b16b/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/486501d84098db21de46860042bb16b15f7e4e4a7aec7ecc89c445947e295dd9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6946eeb1-3b2b-4bd2-8b2d-b04932370599
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
12 / 100
Link:
https://www.joesandbox.com/analysis/1284620
Signature
PE file has a writeable .text section
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/486501d84098db21de46860042bb16b15f7e4e4a7aec7ecc89c445947e295dd9/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jbsqdwcatdnsdxsgqyaefoywwfpx4tskplwh5tejyrczi7rjlxmq._file
Verdict:
unknown
Similar samples:
0116f75b2dfe1d64cd9d19f4cac4d142d29792b966e40c1cbc8ded58adef679b
1b7d7515f98891cf08164a7469bb9c9f3133e7834cfe99d55094594ca330e982
5451af0e6bf3df772cd0905609ad2f23c6e0adb013cd1e418b179ce325e72aff
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230802-wca59agc59/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
240f6396eaa47e0017477dbe19575c7245e163e549d7813f643e0aed952d8ee4
MD5 hash:
ef79f1f68a4d1a0f5c9e26c8befcd23c
SHA1 hash:
ef634cc4d48b6c7fab1011a3ab11f8a9e54d7269
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
af1ffc8987faad6db69957135908a7b825b86189aac12ece951493e84b76412e
MD5 hash:
7777c93aa48338268e993cb9dfba3471
SHA1 hash:
d701cd5381aad0826c1fea2d81f326886ea2a961
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
198ad98cea2c03a0b51adbc26332e3977f764522b8c40c2b4be2cfa3e66751cd
MD5 hash:
3d49defda031acf807a42c57a093f5ee
SHA1 hash:
d4abfd2f9012ee3853a3fbf95fe03823c225aadf
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
90cb229a7a37dcc80e20b54daae3326c923295dab9a7f5a24f54cdacac0ae577
MD5 hash:
c3f4f57e7c86fe208097c792cef3e96f
SHA1 hash:
d4a1d1f5eaafd3a3fade12d384ce792d40506e22
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
018fac27f9a72b9a482673c0456eb73a34a0cd40b3d5be77a0c26f03375e4f3d
MD5 hash:
9fb7422312e05b82e30ee861c0ab6c18
SHA1 hash:
ae670cb70bcb36b7253cf78f5475459b4a4b967a
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
d958e42a8a152a64ac0c3b2c88b6de655fb035d87e768a07da74b0b41d7458d8
MD5 hash:
40bf81060a2dda947038aa3088833df7
SHA1 hash:
a6bf865f79c4af710e3d0373f6fa6296d1f265f3
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
MD5 hash:
f07e819ba2e46a897cfabf816d7557b2
SHA1 hash:
8d5fd0a741dd3fd84650e40dd3928ae1f15323cc
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
bccb5c031ce86b722add00eea424ba3e5aae8ad597b94cb0c841a62e7a8efc95
MD5 hash:
b0b241cfa5b27057de753e4271f5822d
SHA1 hash:
7de8737c4f4853a926fe5dd96864159d524ef66d
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
c2425022f81861ae69ac00c8ef75d87361266a795c46b1e308b7e06add932c0f
MD5 hash:
9f8648ecb2f433aafd120402fb669484
SHA1 hash:
7187eed9fe72bce4a5e7f24838854c0c9effdda6
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
691da042a90fbb8744e3e3e5d6d146e850f924ad1e8ee9539934cc9b38f97bf4
MD5 hash:
2107acfa0872e4ca0a96d3113a12e457
SHA1 hash:
5da00e255c27a4fe89b25a955c9a15a2516080ea
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
bd8eca2c7b3e3d8f56910d5b2bc55b18975fad126af0c761f2ff454dff44b51e
MD5 hash:
9440fa30bad84302251448d79b2075d7
SHA1 hash:
4ac8a881729bcd5a73d0736bce8eebf35f8160bc
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
b1d4e2870fa44aa68e75a93aa29f4f6cec7fc76d97bc877b68c24b0e98e11806
MD5 hash:
103b639b7ce9502d632e969563eaa78f
SHA1 hash:
31fae463116caa40276450f45363036033a312d2
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
40f9b776d183d35c26cac7e118b5bf173fbceb6c1b9969337671bf5a5cb99366
MD5 hash:
e2552b130c5c974388b21f84aabeee0a
SHA1 hash:
2273afe99c5f7d5515019b45308064415456473a
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
d29f8bf6d66a87270b75f2d45ed217b663e2fe43df1a732cea5cfb39a789f479
MD5 hash:
82d1a7521a3ac12f0b0eaaf512497704
SHA1 hash:
19a927a151b7370870247b77ec7b323c8bd19a53
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
03b08c9eb8c4248f02da54f2e725e54ebd779294cc01d55fbd3d21742e3056b9
MD5 hash:
a230f8b75704d2f01b288620b4db621e
SHA1 hash:
f0523e24f10a23408f57c7ea5f077c0826ff5fc9
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
8e1280c30a9a89b89a6331418ee6c1b9917b3626bb9b3137855b47a1dfe68dd7
MD5 hash:
7140bc093a248b7c8123c084a830abc9
SHA1 hash:
87313bd0e9df29c3a3003ec3829af4818d7ea6d3
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
029d829ba80841c31941058c2d6139e0145ade0a48b92e2584b63e842aa5f098
MD5 hash:
9b86973b6e0e3766ec974612ff4eae44
SHA1 hash:
1dafbb155347989a1ffaca6cd5d75236d674cdf9
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
SH256 hash:
486501d84098db21de46860042bb16b15f7e4e4a7aec7ecc89c445947e295dd9
MD5 hash:
ec30b70609bd5542190692d073c1d38d
SHA1 hash:
afff3baca43a3c39dd589a34e096706745cf2da3
Link:
https://www.unpac.me/results/9b809cad-eb95-44ce-8f52-1eb36d1123ac/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/486501d84098db21de46860042bb16b15f7e4e4a7aec7ecc89c445947e295dd9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/439899/

Comments