MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4915139f1b3cb601ac2c3642daf6dc2c0ef560501f04fd1836f699d926d73cbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4915139f1b3cb601ac2c3642daf6dc2c0ef560501f04fd1836f699d926d73cbd
SHA3-384 hash:	1debe6f78f49dad84c7648b17f4a0b18a2e9e980c6b5c7f3801b4b33bed20f2aac8aa5e46544024bd71c3574f2058d26
SHA1 hash:	5568c3e48c753f2545b3f3b36fec55e31161388d
MD5 hash:	6c7d35858dfcf2a345aff05b01342651
humanhash:	equal-cola-double-virginia
File name:	Cunola.exe
Download:	download sample
File size:	86'223'412 bytes
First seen:	2024-02-27 22:07:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (533 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	1572864:A/WHHr90/uSkiYkC7cCA5LhowmX4yYQ6tWUDZRs8nGZC+L7:A/8L9EuSkivWBArmoyHcbD7WE+L7
TLSH	T15E183305E0FDDE6ADE0F12F321924CD3529366084417EE8D25ED2F9F896695A088CF9F
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
dhash icon	98e5676565a5a198 (20 x EpsilonStealer, 2 x NovaSentinel, 1 x LummaStealer)
Reporter	JaffaCakes118
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

465

Origin country :

GB

Vendor Threat Intelligence

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Searching for the window

Сreating synchronization primitives

Creating a process from a recently created file

Creating a window

Creating a file

Running batch commands

Creating a process with a hidden window

Searching for synchronization primitives

Unauthorized injection to a recently created process

Launching a process

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending a custom TCP request

Launching many processes

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/65de5d47c5e1a083fbfae868/reports/7d56a781-c0b6-400b-be6d-95f5599c8aaa/overview

Hybrid Analysis Malware

Verdict:

Suspicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/4915139f1b3cb601ac2c3642daf6dc2c0ef560501f04fd1836f699d926d73cbd

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1399929

Signature

Drops large PE files

Multi AV Scanner detection for dropped file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

13%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/4915139f1b3cb601ac2c3642daf6dc2c0ef560501f04fd1836f699d926d73cbd

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jekrhhy3hs3adlbmgzbnv5w4fqhpkycqd4cp2gbw62m5sjwxhs6q._file

Threatray unknown

Verdict:

unknown

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/240227-118hwacf98/

Behaviour

Checks processor information in registry

Detects videocard installed

Enumerates processes with tasklist

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.