MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 491340696a96a227a4799a9a2467bba4ee512695c96c1b6b4e0451c6d08e5642. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ManusCrypt

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments 1

SHA256 hash:	491340696a96a227a4799a9a2467bba4ee512695c96c1b6b4e0451c6d08e5642
SHA3-384 hash:	d3cadb521969ae91c1ba619a604a1b2a60aa51e236f518ea2032ef9aef773b1f12171afa20503e742a4949d0f87c29f0
SHA1 hash:	c62e919479b755f634c86b63eed9da6179655e40
MD5 hash:	ce063a5d881d7de5f62cd3c41574ccf9
humanhash:	artist-maine-tango-nebraska
File name:	ce063a5d881d7de5f62cd3c41574ccf9
Download:	download sample
Signature	ManusCrypt Create hunting rule
File size:	211'968 bytes
First seen:	2022-12-20 06:36:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	bef982b9edad5be092321ba1afb3822f (8 x ManusCrypt)
ssdeep	6144:Izpmv13cF/p/uwONct43Ep/uwONct43T92USK:ymy9pGHNu4UpGHNu4R2USK
Threatray	595 similar samples on MalwareBazaar
TLSH	T179249D0171C2FC75E5B609761B76CAE0063DFD218F618EEF7398261E5E342D07A3296A
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	787c78fa87f7e6c4 (16 x Gh0stRAT, 11 x Pikabot, 9 x ManusCrypt)
Reporter	zbetcheckin
Tags:	32 exe ManusCrypt

Intelligence

File Origin

# of uploads :

# of downloads :

169

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ce063a5d881d7de5f62cd3c41574ccf9

Verdict:

Malicious activity

Analysis date:

2022-12-20 06:38:50 UTC

Tags:

evasion stealer

Link:

https://app.any.run/tasks/5aa05d55-f0aa-4668-9681-3c2a124fa462

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/348227/

Detection(s):

Win.Dropper.Mokes-9905200-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Creating a file in the %temp% directory

Using the Windows Management Instrumentation requests

Launching a process

Searching for synchronization primitives

Sending a UDP request

Launching the default Windows debugger (dwwin.exe)

Possible injection to a system process

Unauthorized injection to a system process

Gathering data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5dc614c1-8137-4e4e-ab3b-d68b03fb6f48

Result

Threat name:

ManusCrypt

Detection:

malicious

Classification:

bank.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1137713

Signature

Allocates memory in foreign processes

Antivirus detection for dropped file

Antivirus detection for URL or domain

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to detect sleep reduction / modifications

Contains functionality to infect the boot sector

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Creates processes via WMI

Installs new ROOT certificates

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive service information (via WMI, MSSMBios_RawSMBiosTables, often done to detect sandboxes)

Queries temperature or sensor information (via WMI often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sets a auto configuration URL for Internet Explorer (IE settings are enforced automatically)

Sets debug register (to hijack the execution of another thread)

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected ManusCrypt

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/491340696a96a227a4799a9a2467bba4ee512695c96c1b6b4e0451c6d08e5642/

Threat name:

Win32.Backdoor.Manuscrypt

Status:

Malicious

First seen:

2022-12-14 18:58:10 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 26 (84.62%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jejua2lks2rcpjdztknciz53utxfcjuvzfwbw22oari4nueokzba._file

Verdict:

malicious

ManusCrypt

384754e8def3862ee5805476c1c45bbec16d56175dc82438927e02cd98292b24

ManusCrypt

43b37157c5d5822b61744dcb961fb1fa0beebb5c54ae24be8e81b1a747f4b291

ManusCrypt

46cfd217076479473601453a31064e690df15f3f061c3d6a261cf30df5ac3a9d

ManusCrypt

5ad85e0ca6a4d5384059a05aed295abf7e27499bd5cb60b94ae73b885b0b9dfc

ManusCrypt

5c9a81384d49768cd3d01f0786a2c957a8b63da55668fe0270eaef8b3eb2299a

ManusCrypt

7157c19376fe21e77622d0d53b0c6aae720a02fab458db18ac83bde136cede16

ManusCrypt

cb4ab17937b1bac693e70b9ae09666bed0510559b3f3d34c929f404368a4c2af

ManusCrypt

f63dc116cf6f2bf6c2f33898d73ef0b974ed3fa9de67d840b50b35ee2d9390d9

ManusCrypt

+ 585 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://tria.ge/reports/221220-hdggrsgh62/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies registry class

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in System32 directory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Loads dropped DLL

Unexpected DNS network traffic destination

Process spawned unexpected child process

Suspicious use of NtCreateUserProcessOtherParentProcess

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/724e2a90-7483-426a-b62c-b2b098556c55

Unpacked files

SH256 hash:

491340696a96a227a4799a9a2467bba4ee512695c96c1b6b4e0451c6d08e5642

MD5 hash:

ce063a5d881d7de5f62cd3c41574ccf9

SHA1 hash:

c62e919479b755f634c86b63eed9da6179655e40

Link:

https://www.unpac.me/results/fde277aa-0936-4922-8fa2-9a3e64aba487/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/491340696a96a227a4799a9a2467bba4ee512695c96c1b6b4e0451c6d08e5642

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.