MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a19698c60f3a33896d21da1be688c2ed06deb0bda85b08bc4ac9e81c56c2b69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Lucifer


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a19698c60f3a33896d21da1be688c2ed06deb0bda85b08bc4ac9e81c56c2b69
SHA3-384 hash: b46a90831bfe60b52ce9d0ab398bb125cb140d2d38cb065d71c8dc01eaa13ffc6617e97c7d5e93ee97f33f526eb6cc6d
SHA1 hash: a3555f45934345b6e3d0094161ef48dfaa6e59bd
MD5 hash: cc5ca9b3ff4365fa30c049991e0fc651
humanhash: sad-mirror-echo-nineteen
File name:cc5ca9b3ff4365fa30c049991e0fc651.exe
Download: download sample
Signature Lucifer
Create hunting rule
File size:563'712 bytes
First seen:2022-08-11 06:26:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:t+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWYflr5XsyJdvU:0Pw2PjCLe3a6Q70zbp5XXTc
Threatray 48 similar samples on MalwareBazaar
TLSH T191C4490223FC4BA6E5FE6B31A531424543F6FD82567BD70D1D80A5EA4C777829E203AB
TrID 37.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
22.0% (.EXE) InstallShield setup (43053/19/16)
15.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
6.7% (.SCR) Windows screen saver (13101/52/3)
5.3% (.EXE) Win64 Executable (generic) (10523/12/4)
File icon (PE):PE icon
dhash icon 414555c0d4d44503 (15 x njrat, 14 x BlackNET, 8 x Lucifer)
Reporter abuse_ch
Tags:exe Lucifer

Intelligence

File Origin
# of uploads :
1
# of downloads :
291
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cc5ca9b3ff4365fa30c049991e0fc651.exe
Verdict:
Malicious activity
Analysis date:
2022-08-11 06:30:59 UTC
Tags:
installer evasion
Link:
https://app.any.run/tasks/08bd9844-a8d7-41f6-8b13-44e99622b185

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/297861/
Detection(s):
Win.Packed.Msilperseus-9956591-0
Create hunting rule

Win.Packed.Msilperseus-9956592-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Creating a file
Reading critical registry keys
Creating a process from a recently created file
Searching for synchronization primitives
Moving of the original file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a recently created process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm evasive fingerprint packed packed stealer
Link:
https://www.filescan.io/uploads/62f4a177810e2831b737c370/reports/f884120f-8d66-4851-a575-c69d2af27edf/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/19062eee-2ad4-4953-b6a1-85fa49bbe705
Result
Threat name:
Predator
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
99 / 100
Link:
https://www.joesandbox.com/analysis/1049746
Signature
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found C&C like URL pattern
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Generic Downloader
Yara detected Predator
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 682240 Sample: VFMPwzPWjM.exe Startdate: 11/08/2022 Architecture: WINDOWS Score: 99 32 ip-api.com 2->32 46 Snort IDS alert for network traffic 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus detection for URL or domain 2->50 52 8 other signatures 2->52 7 VFMPwzPWjM.exe 15 33 2->7         started        12 update_221109.exe 14 3 2->12         started        14 update_221109.exe 4 2->14         started        signatures3 process4 dnsIp5 34 big009.xyz 188.114.96.3, 49741, 49771, 49786 CLOUDFLARENETUS European Union 7->34 36 188.114.97.3, 49742, 49751, 49758 CLOUDFLARENETUS European Union 7->36 38 2 other IPs or domains 7->38 22 C:\Users\user\AppData\Local\Temp\Zip.exe, PE32 7->22 dropped 24 C:\Users\user\Desktop24ewtonsoft.Json.dll, PE32 7->24 dropped 26 C:\Users\user\AppData\...26ewtonsoft.Json.dll, PE32 7->26 dropped 54 May check the online IP address of the machine 7->54 56 Moves itself to temp directory 7->56 58 Performs DNS queries to domains with low reputation 7->58 16 Zip.exe 14 4 7->16         started        60 Tries to harvest and steal browser information (history, passwords, etc) 14->60 20 Zip.exe 14->20         started        file6 signatures7 process8 dnsIp9 28 ip-api.com 16->28 40 Multi AV Scanner detection for dropped file 16->40 42 May check the online IP address of the machine 16->42 44 Machine Learning detection for dropped file 16->44 30 ip-api.com 20->30 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a19698c60f3a33896d21da1be688c2ed06deb0bda85b08bc4ac9e81c56c2b69/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-08-11 00:59:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
34
AV detection:
25 of 26 (96.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jimwtdda6ortrfwsdwq342emf3ig32yl3kc3bc6evspidrlmfnuq._file
Verdict:
malicious
Similar samples:
870f6ee038047eaf74564a88e5720843676d449d4bfd7e893e0958851e7f5a3c
Lucifer
b72e48f5e44ac62ff8a6946d030f1d156d0ecd2c6f6a38e42df69b1290d7fd7e
Lucifer
c14b0b8755871a595d9e9ae5aaa00dfc611a36b6198d5703b38c535e31688675
Lucifer
d91bf42c9a19921e75c845ee57eb7a4b5e73c7872b50cd78b8ab4c6b01f26ace
Lucifer
d9536057855ddfa0656463b11191f1fd1a34f95032c676f7d3afc7cd5372068b
Lucifer
f62eb2c218ce5b7958aa7fcd2aa5c604fcc571e10bb4c373bb396d9e85733e44
Lucifer
+ 38 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
collection discovery persistence spyware stealer
Link:
https://tria.ge/reports/220811-g7rn6abghk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
ac339deed84cafab79d2a4bc7b232849a0232b2664dbd56c12b5c90e90a91c32
MD5 hash:
f532e03f70df6dd099be185f501d9fe0
SHA1 hash:
a637e7559d9e4963b74ce29bdf30dc4632e574f2
Link:
https://www.unpac.me/results/b1a2ae35-146f-4b21-b0de-22bc347952d4/
SH256 hash:
bf78263914c6d3f84f825504536338fadd15868d788bf30d30613ca27abeb7a9
MD5 hash:
3afd64484a2a34fc34d1155747dd3847
SHA1 hash:
451e1d878179f6fcfbaf9fa79d9ee8207489748f
Link:
https://www.unpac.me/results/b1a2ae35-146f-4b21-b0de-22bc347952d4/
SH256 hash:
4a19698c60f3a33896d21da1be688c2ed06deb0bda85b08bc4ac9e81c56c2b69
MD5 hash:
cc5ca9b3ff4365fa30c049991e0fc651
SHA1 hash:
a3555f45934345b6e3d0094161ef48dfaa6e59bd
Link:
https://www.unpac.me/results/b1a2ae35-146f-4b21-b0de-22bc347952d4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4a19698c60f3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a19698c60f3a33896d21da1be688c2ed06deb0bda85b08bc4ac9e81c56c2b69

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_VPN
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many VPN software clients. Observed in infosteslers
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Lucifer

Executable exe 4a19698c60f3a33896d21da1be688c2ed06deb0bda85b08bc4ac9e81c56c2b69

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2270599/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/297861/

Comments