MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 495af6172a43747c7b0c987be287b1ff17e16b8e0aa247d123621568bf8fa3c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	495af6172a43747c7b0c987be287b1ff17e16b8e0aa247d123621568bf8fa3c6
SHA3-384 hash:	669b36b465b0f4cc96d4a66c5b36a0407938340cfc83ae554964689717cc047e8e64a2a670d21fbdb2fe8d1a886e97dc
SHA1 hash:	185cbefab3f51ba74140e32d2c0d7b1cc6c2e32d
MD5 hash:	654da63bac658f27cc0b12a6a3cf443c
humanhash:	moon-salami-crazy-jersey
File name:	SecuriteInfo.com.Trojan.DownLoaderNET.688.32409.9930
Download:	download sample
File size:	50'176 bytes
First seen:	2023-07-28 10:37:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	768:p60DXYj8+GVq8zaWo2a4ikkRio0YOv3gDq7nC8/qKX830BU+KELDKP6JJc+ia:pbLYj8+GVq8zSRTrigfnKi0vr3KcJjia
Threatray	754 similar samples on MalwareBazaar
TLSH	T10D335B0D278D6633D6BC797DC4EA524423BAA2B73702E34F9FC451A80A93BDD4543A87
TrID	56.5% (.EXE) Win64 Executable (generic) (10523/12/4) 11.0% (.ICL) Windows Icons Library (generic) (2059/9) 10.9% (.EXE) OS/2 Executable (generic) (2029/13) 10.7% (.EXE) Generic Win/DOS Executable (2002/3) 10.7% (.EXE) DOS Executable Generic (2000/1)
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

262

Origin country :

FR

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

SecuriteInfo.com.Trojan.DownLoaderNET.688.32409.9930

Verdict:

Malicious activity

Analysis date:

2023-07-28 10:38:47 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/58817d31-2966-4573-bc8c-11422b2715f4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/435895/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.DownLoaderNET.688.32409.9930.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

DNS request

Сreating synchronization primitives

Sending a custom TCP request

Sending an HTTP GET request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/64c39a8d2a568ab215b90eda/reports/40b1da8a-f5b1-434b-9326-356ce7629001/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/495af6172a43747c7b0c987be287b1ff17e16b8e0aa247d123621568bf8fa3c6

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1acc79ed-90c4-445d-a5aa-e55c73addfc1

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1281764

Signature

.NET source code contains potential unpacker

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/495af6172a43747c7b0c987be287b1ff17e16b8e0aa247d123621568bf8fa3c6/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.Generic

Threat name:

ByteCode-MSIL.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-07-27 14:18:49 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

4

AV detection:

17 of 24 (70.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jfnpmfzkin2hy6ymtb56fb5r74l6c24obkrepujdmikwrp4pupda._file

Threatray malicious

Verdict:

malicious

Similar samples:

24b05dea7290ca2ab8b49c9efd04492a09fc3e7d6cafba2003316c2a80155645

4a269414d116334ba8837a573d824a3ff46c3b7d274b7b8e3c3ffd688a2e3729

66ec3c9fb1339c6925fb508c17190aa7869e24b149abcedd771aa53ea9de27fa

79bcd1456826ac8e36a6a0caf78600609f2cdb7d4b991e63313bc5651dbc4e93

8be2a3d913c8851bffa0a682c9fb393d614a108e142344987ff9c8712d48c8c3

a6d0e60e46974bcc2b95d79efe42aef131019e1a1db2f71a780c51a68cc36199

cda3ab9c1f6fb75333b3e1b70036efa8778f346946442285a275f4f6358e181d

cffee94b2fed3ea5bf85eb7bab308ac9488d1ed882c02787ee318760b1a90350

ef634f411178f4e4b177515d80dd363158a73004da3229b07789d696d7c8dea8

+ 744 additional samples on MalwareBazaar

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/230728-mpd81ade7x/

Behaviour

Suspicious use of AdjustPrivilegeToken

UnpacMe

Unpacked files

SH256 hash:

495af6172a43747c7b0c987be287b1ff17e16b8e0aa247d123621568bf8fa3c6

MD5 hash:

654da63bac658f27cc0b12a6a3cf443c

SHA1 hash:

185cbefab3f51ba74140e32d2c0d7b1cc6c2e32d

Link:

https://www.unpac.me/results/65a6732d-a22e-4a16-800b-d35a30e6a7f4/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/495af6172a43747c7b0c987be287b1ff17e16b8e0aa247d123621568bf8fa3c6

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/435895/