MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a8da72abff64bcf80a2500077504588b720180b7694203bdb2434fa075fa7fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a8da72abff64bcf80a2500077504588b720180b7694203bdb2434fa075fa7fa
SHA3-384 hash: 8eb135696ebd3d9edc7b79803cd9aec1ff0c7a0c6e9da7e0116f1f9b6dc141078300955604bce7b97a1ffb156512047a
SHA1 hash: 3efcf54ebe6055f2f0e1abafb779c2fff703e067
MD5 hash: 3f0ef0127e8dbdd65d60a6998dacbd7c
humanhash: may-neptune-louisiana-don
File name:SecuriteInfo.com.IL.Trojan.MSILZilla.26395.775.29664
Download: download sample
File size:626'688 bytes
First seen:2023-06-02 07:29:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:oJUeikEnNHJ1Ar62kxa1sBOwlM0x9Bk6pzDhFZ0CGqX/aNSpGb1fy5MW23dqYq:0vW4wlfxc6JDd/X/EeMcMW2V
Threatray 364 similar samples on MalwareBazaar
TLSH T12DD423484CF3B285E710503D07721BDA9BF4626FC599BC566E4D852088FB39D1AFA28F
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
233
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.IL.Trojan.MSILZilla.26395.775.29664
Verdict:
Malicious activity
Analysis date:
2023-06-02 07:31:42 UTC
Tags:
stealer blackguard
Link:
https://app.any.run/tasks/9cc605ba-53c6-4ff6-bf14-950ace14c10a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/394706/
Detection(s):
SecuriteInfo.com.IL.Trojan.MSILZilla.26395.775.29664.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Creating a file
Launching a process
Creating a process from a recently created file
Deleting a recently created file
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
comodo lokibot packed warzone
Link:
https://www.filescan.io/uploads/64799a7c5505e69a232498a3/reports/5e8b325a-6536-43be-b0c5-8f31a2690ed7/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/4a8da72abff64bcf80a2500077504588b720180b7694203bdb2434fa075fa7fa
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/53c9fea4-9a84-46ca-8954-49319193cb36
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1247444
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 880464 Sample: SecuriteInfo.com.IL.Trojan.... Startdate: 02/06/2023 Architecture: WINDOWS Score: 100 49 Antivirus / Scanner detection for submitted sample 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 .NET source code contains potential unpacker 2->53 55 4 other signatures 2->55 6 Resources.exe 3 2->6         started        9 cmd.exe 1 2->9         started        11 SecuriteInfo.com.IL.Trojan.MSILZilla.26395.775.29664.exe 7 2->11         started        process3 file4 57 Antivirus detection for dropped file 6->57 59 Multi AV Scanner detection for dropped file 6->59 61 Machine Learning detection for dropped file 6->61 65 2 other signatures 6->65 14 MSBuild.exe 16 3 6->14         started        19 ywkgizrpa.pif 11 9->19         started        21 conhost.exe 9->21         started        23 C:\Users\user\AppData\Local\...\Resources.exe, PE32 11->23 dropped 25 SecuriteInfo.com.I...5.775.29664.exe.log, ASCII 11->25 dropped 27 C:\Users\...\Resources.exe:Zone.Identifier, ASCII 11->27 dropped 63 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 11->63 signatures5 process6 dnsIp7 31 84.54.50.125, 49700, 49702, 49703 LVLT-10753US Germany 14->31 33 files.catbox.moe 107.160.74.131, 443, 49701 AS40676US United States 14->33 29 C:\Users\user\AppData\Local\...\ywkgizrpa.pif, PE32+ 14->29 dropped 37 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->37 39 Drops PE files with a suspicious file extension 14->39 35 226.127.10.0.in-addr.arpa 19->35 41 Multi AV Scanner detection for dropped file 19->41 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->43 45 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->45 47 4 other signatures 19->47 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a8da72abff64bcf80a2500077504588b720180b7694203bdb2434fa075fa7fa/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-06-01 22:46:47 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jkg2okv76zf47afckaahoucfrc3sagalo2kcao63eq2pub27u75a._file
Verdict:
malicious
Similar samples:
1c758992ed57930115ba585a43bc0a7a750a476206cf1999bf3333f26fc230f2
65bea8ecbc22a05fe6cdd7108d9859e22de0a6796c7597ff299e4baf0dde04ad
6a019592f49db789478da1f5a63e673824a8bffacff9f99c5528072fb3b95ba1
812f2741f662194744b33d6e51c4fbe11823d06e90938865aa4517974a072bc1
a130830dbd995f4e11fd9572076a51db0ea6fa0c4d7c57acc2c72274c05d408a
a7496f64d8f6fedf5d7684e9b073afc39f7f0254ca3a35de6383445a9235329e
cfe0ce3795f3c45d3945d05c010f35e08e42036045e41aa3cf63cb1fb32d2ca6
e0b361a5a568b0620b57e5af25e0627597c0633c285080a490e221c896ae5372
f1b80af506aaf5f0f42514a80a0e5a9828b59a567337554983532308ab3a996f
+ 354 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
collection spyware stealer
Link:
https://tria.ge/reports/230602-jbs88aad55/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Executes dropped EXE
Reads user/profile data of web browsers
Downloads MZ/PE file
Unpacked files
SH256 hash:
e1a530e4ca05f6c5b556d3e0de292b69a399c76bae6228b745ab702e558ff07d
MD5 hash:
4933b6a16f69f7850f18287fcbfd9e47
SHA1 hash:
f7f35a5537379d702e302c84d8f6a478d94e2335
Link:
https://www.unpac.me/results/dfa53c5e-1033-4f29-b2e1-83a6c08aa35b/
SH256 hash:
6b77e2bfff019609c509c3e559c6870dbb7e8d8b9979affb98440e079c99e354
MD5 hash:
958e4d62824c29a594256646c3d6bbf9
SHA1 hash:
e2f2004a3932381c8e70ecde39a129f0f6add9b0
Link:
https://www.unpac.me/results/dfa53c5e-1033-4f29-b2e1-83a6c08aa35b/
SH256 hash:
a10dfd31865b8f24e36ab9171e3ab0c602ff30bbfe25a46d623d7d70bdfe9eb7
MD5 hash:
186b34a1d4a1e1949c86177b18ccdd31
SHA1 hash:
dc41636df451380d6315afcf846d871dfa586c72
Link:
https://www.unpac.me/results/dfa53c5e-1033-4f29-b2e1-83a6c08aa35b/
SH256 hash:
b81e13f2bb560d591b21f6841c511d3d3cc83163d7891366e7a90589959c8d63
MD5 hash:
3d88d64d73d0c483abb0a5258ae525bf
SHA1 hash:
0ec5aed0a0cff837fb7ac6e7392544d7d9607b1e
Link:
https://www.unpac.me/results/dfa53c5e-1033-4f29-b2e1-83a6c08aa35b/
SH256 hash:
4a8da72abff64bcf80a2500077504588b720180b7694203bdb2434fa075fa7fa
MD5 hash:
3f0ef0127e8dbdd65d60a6998dacbd7c
SHA1 hash:
3efcf54ebe6055f2f0e1abafb779c2fff703e067
Link:
https://www.unpac.me/results/dfa53c5e-1033-4f29-b2e1-83a6c08aa35b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4a8da72abff6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a8da72abff64bcf80a2500077504588b720180b7694203bdb2434fa075fa7fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 4a8da72abff64bcf80a2500077504588b720180b7694203bdb2434fa075fa7fa

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/394706/
  
URLhaus
https://urlhaus.abuse.ch/url/2649754/
  
Delivery method
Distributed via web download

Comments