MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49286f0e2951a1c5a10e0b3a124583d99785418ab64d54b2950144adf6e83e00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	49286f0e2951a1c5a10e0b3a124583d99785418ab64d54b2950144adf6e83e00
SHA3-384 hash:	dd89fc428cfb6c4b3313e73c4ac8b11b0adc1cd368c29ca6d92794d13b58b9ac3973797f1c43063b1f0a9a591abe6594
SHA1 hash:	52bf1ac2dec56f472de8f7b49f3fa712f1fe6cf0
MD5 hash:	152b342fd75250233fc16e8e911d930a
humanhash:	burger-moon-shade-high
File name:	SecuriteInfo.com.Win32.Evo-gen.3759.26923
Download:	download sample
File size:	2'297'655 bytes
First seen:	2023-09-30 05:29:37 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	32569d67dc210c5cb9a759b08da2bdb3 (122 x RedLineStealer, 42 x DiamondFox, 37 x RaccoonStealer)
ssdeep	49152:mcBIX10t+zDHZvSy0wcxD+WDoms4WAjrHSROCuiloiBd:mlX10035vSdhlQmsd2HcOCuiloM
Threatray	1'197 similar samples on MalwareBazaar
TLSH	T1A9B533337BFA11FFD613353189189F7562AA939C46202CAB1320C90F2B3C5A1D7697B5
TrID	33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 21.3% (.EXE) Win64 Executable (generic) (10523/12/4) 13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox)
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

285

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/452192/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.Evo-gen.3759.26923.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Running batch commands

Launching a process

Сreating synchronization primitives

Creating a process with a hidden window

Sending a custom TCP request

Searching for the window

Dragonfly

Gathering data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

installer lolbin overlay packed SFX shell32

Link:

https://www.filescan.io/uploads/6517b25d935d595cf276a67c/reports/1e7863b8-9f01-45e6-ba52-4dbb408cfe03/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/49286f0e2951a1c5a10e0b3a124583d99785418ab64d54b2950144adf6e83e00

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d9474fac-80ad-4c13-ae1e-b553fb1ef65a

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1317080

Signature

Antivirus detection for dropped file

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/49286f0e2951a1c5a10e0b3a124583d99785418ab64d54b2950144adf6e83e00/

ReversingLabs TitaniumCloud Win32.Trojan.Vigorf

Threat name:

Win32.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-09-30 05:30:07 UTC

File Type:

PE (Exe)

Extracted files:

8

AV detection:

15 of 23 (65.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jeug6drjkgq4liiobm5bermd3glykqmkwzgvjmuvafck35xihyaa._file

Threatray malicious

Verdict:

malicious

Similar samples:

66bf743babad7405d2426b25bf8d1bb493f6d9048b55ede138d36a3b8a2f9c8e

67a38378609c0eb8141a74e7baa052b01ff5734319b4e434e556c88fffd596b9

dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a

dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818

e026bc9a0b7ac31a86cdbbd88e2b2be5236ba81b469723007c8b3c1d9461198f

e461562a06f4c2cea8cc91d9fc6fd75f393b79030d6463169f71b0ff2f6b7ded

e6ea98b046b11a35efa0ac1243f6190ff4d4247a35784e65a9feaaf4918ae779

+ 1'187 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230930-f65zqaad89/

Behaviour

Suspicious use of WriteProcessMemory

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

b601545810eb9cd54fc4096cb7fba9f8511c497353d48c625e68fab98aff2faf

MD5 hash:

a9be8a37556ded5ca54a697adbbc766b

SHA1 hash:

d5e3527cbbc5b46759342c9e3a42bc366896cb53

Link:

https://www.unpac.me/results/bba3a2b4-23b9-42f4-b954-22ec6cc0394a/

SH256 hash:

49286f0e2951a1c5a10e0b3a124583d99785418ab64d54b2950144adf6e83e00

MD5 hash:

152b342fd75250233fc16e8e911d930a

SHA1 hash:

52bf1ac2dec56f472de8f7b49f3fa712f1fe6cf0

Link:

https://www.unpac.me/results/bba3a2b4-23b9-42f4-b954-22ec6cc0394a/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/49286f0e2951a1c5a10e0b3a124583d99785418ab64d54b2950144adf6e83e00

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 49286f0e2951a1c5a10e0b3a124583d99785418ab64d54b2950144adf6e83e00

(this sample)

Cape

https://www.capesandbox.com/analysis/452192/

  

URLhaus

https://urlhaus.abuse.ch/url/2715154/

  

Delivery method

Distributed via web download