MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a398178279e2a5f10d642314a3d091872797ea1746f37a3771eaf85a5f764e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a398178279e2a5f10d642314a3d091872797ea1746f37a3771eaf85a5f764e3
SHA3-384 hash: 0918012ae12573f6c589f9f58446da08a4708f8c3eb3c9662fd9181ec1dc8c03f7050214f5d4287bff880336909b278b
SHA1 hash: d97f392cf0b492c074eced973f65568d96da2c0e
MD5 hash: 9cd6eba44f4ca4a3adb3fc0323f67a00
humanhash: fish-stairway-hawaii-music
File name:4a398178279e2a5f10d642314a3d091872797ea1746f37a3771eaf85a5f764e3
Download: download sample
File size:931'840 bytes
First seen:2020-11-12 14:33:33 UTC
Last seen:2024-07-24 13:54:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 647b2d25b4821905b4195ff7a6455b54 (5 x DarkComet)
ssdeep 12288:oloZZEOZYVCPauTr4vcS5LEwkVHloZZEOZYVCPauTr4vcS5LEwkVM:jVZYVOxrtcu6VZYVOxrtcuM
Threatray 7 similar samples on MalwareBazaar
TLSH 8315234AD8AA94C5C465B3BE57A98EF3E5F0BD0AFC80C1731BE3BD815D624954210F3A
Reporter seifreed

Intelligence

File Origin
# of uploads :
2
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the Windows subdirectories
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a file
Moving a recently created file
Searching for the window
Launching the default Windows debugger (dwwin.exe)
DNS request
Sending an HTTP GET request
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/533641
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates HTML files with .exe extension (expired dropper behavior)
Drops PE files to the document folder of the user
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Uses dynamic DNS services
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 315925 Sample: Y7i2sl4Foh Startdate: 13/11/2020 Architecture: WINDOWS Score: 100 60 xred.mooo.com 2->60 64 Multi AV Scanner detection for domain / URL 2->64 66 Antivirus detection for dropped file 2->66 68 Antivirus / Scanner detection for submitted sample 2->68 70 6 other signatures 2->70 9 Y7i2sl4Foh.exe 1 6 2->9         started        13 Synaptics.exe 2 2->13         started        15 EXCEL.EXE 23 16 2->15         started        signatures3 process4 file5 44 C:\Users\user\...\._cache_Y7i2sl4Foh.exe, PE32 9->44 dropped 46 C:\ProgramData\Synaptics\Synaptics.exe, PE32 9->46 dropped 48 C:\ProgramData\Synaptics\RCX42BC.tmp, PE32 9->48 dropped 50 C:\...\Synaptics.exe:Zone.Identifier, ASCII 9->50 dropped 82 Antivirus detection for dropped file 9->82 84 Machine Learning detection for dropped file 9->84 17 Synaptics.exe 72 9->17         started        22 ._cache_Y7i2sl4Foh.exe 9->22         started        52 C:\ProgramData\...\._cache_Synaptics.exe, PE32 13->52 dropped 24 ._cache_Synaptics.exe 13->24         started        signatures6 process7 dnsIp8 54 xred.site50.net 153.92.0.100, 49748, 49749, 49782 AWEXUS Germany 17->54 56 freedns.afraid.org 50.23.197.94, 49736, 80 SOFTLAYERUS United States 17->56 58 12 other IPs or domains 17->58 36 C:\Users\user\DocumentsbehaviorgraphAOBCVIQIJ\~$cache1, PE32 17->36 dropped 38 C:\Users\user\Desktop\Y7i2sl4Foh.exe, PE32 17->38 dropped 40 C:\Users\user\Desktop\._cache_Synaptics.exe, PE32 17->40 dropped 42 3 other malicious files 17->42 dropped 72 Antivirus detection for dropped file 17->72 74 Multi AV Scanner detection for dropped file 17->74 76 Drops PE files to the document folder of the user 17->76 78 Creates HTML files with .exe extension (expired dropper behavior) 17->78 26 ._cache_Synaptics.exe 17->26         started        80 Machine Learning detection for dropped file 22->80 29 WerFault.exe 23 9 22->29         started        32 WerFault.exe 24->32         started        file9 signatures10 process11 dnsIp12 86 Antivirus detection for dropped file 26->86 88 Multi AV Scanner detection for dropped file 26->88 90 Machine Learning detection for dropped file 26->90 34 WerFault.exe 19 9 26->34         started        62 192.168.2.1 unknown unknown 29->62 signatures13 process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a398178279e2a5f10d642314a3d091872797ea1746f37a3771eaf85a5f764e3/
Threat name:
Win32.Backdoor.GrayBird
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 14:36:20 UTC
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1a64802e01d94712cb6daf8339296b78cf0a7a81251e80937d01d975b31938dc
252ed32b4eaa2631fd004cb2124b6fd02a76f729a78ca51354cef21dd69f8cb5
422761ce807ba569d378b3130493e84a531d310d1ed8e0559d6313fdf91cd5b0
664b7a3c0a0f414b711f0b0f632669de0dac794fd029cb13f3b292717d3c7196
d8d750910aac8726d8cb50476b6a5b6635e6d8ce3ecd02d562c637269d1a1088
eaf4c919002576a1aa5c7729d2f953d8c0fcc2c4d34b3597ec15c207ef026e05
fe19c0cd68bc2cf6045a8a0585ec0ed3f520d4093032f6a05759b8c408b5cce3
Result
Malware family:
n/a
Score:
  9/10
Tags:
persistence upx
Link:
https://tria.ge/reports/201112-efw2hpc45e/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies registry class
Program crash
Adds Run key to start application
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
UPX packed file
ServiceHost packer
Unpacked files
SH256 hash:
4a398178279e2a5f10d642314a3d091872797ea1746f37a3771eaf85a5f764e3
MD5 hash:
9cd6eba44f4ca4a3adb3fc0323f67a00
SHA1 hash:
d97f392cf0b492c074eced973f65568d96da2c0e
Link:
https://www.unpac.me/results/0c585ca8-82ff-494b-ab3f-bd02ba56444e/
SH256 hash:
a377ae35498ea0a70731ff2cf79d61290229540436dab97ac4c2cddec1a2d821
MD5 hash:
7f72642ac39c157003c3f990211918d0
SHA1 hash:
be2db16e421dd3a9b3577f536fb2bf937797949f
Link:
https://www.unpac.me/results/0c585ca8-82ff-494b-ab3f-bd02ba56444e/
SH256 hash:
abf0be1a80e78bd377c073c9aeb00185dce4f0f86f5598aa07d6af2e624e1c39
MD5 hash:
d3aed5521c864ff24a217633db71e958
SHA1 hash:
43c9806f7bd948fb65bf0d9df9acd67e6ad313cb
Link:
https://www.unpac.me/results/0c585ca8-82ff-494b-ab3f-bd02ba56444e/
SH256 hash:
b9eae90f8e942cc4586d31dc484f29079651ad64c49f90d99f86932630c66af2
MD5 hash:
c0ef4d6237d106bf51c8884d57953f92
SHA1 hash:
f1da7ecbbee32878c19e53c7528c8a7a775418eb
Link:
https://www.unpac.me/results/0c585ca8-82ff-494b-ab3f-bd02ba56444e/
SH256 hash:
ded773780f4e41c2e4afce73070f84fffc4174959acd2ed2a30e0e70225e6793
MD5 hash:
a16b56cac81a010cde16db424e2c65fd
SHA1 hash:
f968bc81181f131efc2d4461b21a630048d747c4
Link:
https://www.unpac.me/results/0c585ca8-82ff-494b-ab3f-bd02ba56444e/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments