MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a81c4e4b235e6da31c71a695510070de92a4fe785d61bf29768b56348e2d982. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a81c4e4b235e6da31c71a695510070de92a4fe785d61bf29768b56348e2d982
SHA3-384 hash: 5f8e18a46f48c30fdbb5c87b1d79934bd0310d0d8dedd99b8f0cfc23d18ec3a8533c20c404baa60d8c40436d157f318a
SHA1 hash: 83bbee87b8e459cf93ce0eb2360addf43dfe48fd
MD5 hash: bac2e0a4fc4cb59b72f3168d93d67493
humanhash: friend-skylark-speaker-table
File name:bac2e0a4fc4cb59b72f3168d93d67493.exe
Download: download sample
File size:1'801'971 bytes
First seen:2023-04-09 07:39:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ab9ff6e4872ea2766a5f5c6af5649e9d (20 x CryptOne, 13 x RedLineStealer, 6 x RecordBreaker)
ssdeep 49152:4J4cqakaVbXHvZ2wp6v89bgTNItqlTiyoeGs:4J4xahbx26J9MTr2/E
Threatray 136 similar samples on MalwareBazaar
TLSH T116852312B9C084F1D97254351EE39AB12A3D3E205B67CDDF43653B6D5B701C0AB3AA72
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
256
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bac2e0a4fc4cb59b72f3168d93d67493.exe
Verdict:
No threats detected
Analysis date:
2023-04-09 07:40:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f42b7870-745c-41af-b8bb-6477267a589d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/381086/
Detection(s):
Win.Malware.Fugrafa-9938779-0
Create hunting rule

SecuriteInfo.com.Variant.Fugrafa.249470.10364.14457.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/77148/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bladabindi enigma greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/64326bd6bf68c1790afb1d80/reports/90cbc99b-cd70-4085-9465-f18375299395/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/4a81c4e4b235e6da31c71a695510070de92a4fe785d61bf29768b56348e2d982
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/3bb868ba-7e22-47fa-92ae-1536523ebb1c
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
39 / 100
Link:
https://www.joesandbox.com/analysis/1210850
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a81c4e4b235e6da31c71a695510070de92a4fe785d61bf29768b56348e2d982/
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2023-04-09 01:27:06 UTC
File Type:
PE (Exe)
Extracted files:
39
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jka4jzfsgxtnumohdjuvkeahbxusut7hqxlbx4uxnc2wgshc3gba._file
Verdict:
malicious
Similar samples:
2551a9e1052a5b3cfcef38482db2a1b0d2b85f3889b0ebc9b0a9a77bbadc940d
3f63a50f468fe3edea949b795d7ab6cd13c2cce8e73998556072fbeb97341bb1
6bc2d4c7cf6c183e47b32a0a9f6802ef785f6d7938e452248e3f00b2b37162aa
70caeb1acf2902a83cc604e44bffed2b43c0698a5e101f12b6f1a6f9eeccc546
8725f5edcadc9327d76c8d87e9ad054f7a4acc78f66c8cccd5272472f5201f46
b4bd83aafbbe1e231c5793ee0a926878773229d9afe79b776bdb175a544b7567
d2bb9f5fab68fab2a4247031c1c4254f54f0e59a237f44a73390da90d87cec58
e9b5861c31edac2ccbf35a953c768ef15d221b448102123485ace59253388985
f0befbf3bc4aab1422ef8653f2a85d6ffa0f1eba7f9cecb5a5279600a6daabee
f8ba98c4f7f9ccf0520492b17b56a57e69c7624e497fca78007766cdce05b947
+ 126 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230409-jhjncsbg2z/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
4a81c4e4b235e6da31c71a695510070de92a4fe785d61bf29768b56348e2d982
MD5 hash:
bac2e0a4fc4cb59b72f3168d93d67493
SHA1 hash:
83bbee87b8e459cf93ce0eb2360addf43dfe48fd
Link:
https://www.unpac.me/results/41cf63a5-4fa0-4b88-8bb7-d15aa5ed8b1f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a81c4e4b235e6da31c71a695510070de92a4fe785d61bf29768b56348e2d982

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 4a81c4e4b235e6da31c71a695510070de92a4fe785d61bf29768b56348e2d982

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/381086/
  
URLhaus
https://urlhaus.abuse.ch/url/2261300/
  
Delivery method
Distributed via web download

Comments