MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ab10d52e602bf25abe1f7907182dda6df5f75aa06f7745caa70728134882907. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ab10d52e602bf25abe1f7907182dda6df5f75aa06f7745caa70728134882907
SHA3-384 hash: 0b633bff3d9fcdaaabed08960c7ac9133c54be28ef5012a61a98a9c333da6dea406cbc9481641db4508f3a9619eae9c1
SHA1 hash: ab2d4cab545f99ddc61568a288a4a6958bdc3d4c
MD5 hash: d3f0ee0b1cf3c0a1abb95eb19acc92fe
humanhash: ten-orange-massachusetts-robin
File name:Rec1b0_fev_0223.msi
Download: download sample
File size:11'949'568 bytes
First seen:2023-02-13 08:11:02 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:ya9lzsHBrkuBGwjjlD2nKy3f5rK8bIPfdR5JQGYmGYbA3wuwas7xpSg0OR:dshLBTnl6nz3fI8bIPfpPlbUw41OR
Threatray 103 similar samples on MalwareBazaar
TLSH T1D0C62325A287C922D52D017BE4A8EF4E4134BEB3533455F7B7F93E5A48F0CC162B9A06
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter 0xToxin
Tags:msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
IL IL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/364871/
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware keylogger packed shell32.dll virus
Link:
https://www.filescan.io/uploads/63e9f09a6ea97adc8fc09346/reports/82a50515-9758-4e17-88b0-c686a6c6415f/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/4ab10d52e602bf25abe1f7907182dda6df5f75aa06f7745caa70728134882907
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/4ab10d52e602bf25abe1f7907182dda6df5f75aa06f7745caa70728134882907
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1173116
Signature
Antivirus detection for dropped file
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ab10d52e602bf25abe1f7907182dda6df5f75aa06f7745caa70728134882907/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-02-09 10:35:29 UTC
File Type:
Binary (Archive)
Extracted files:
200
AV detection:
11 of 26 (42.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jkyq2uxgak7slk7b66ihdaw5u3pv65nka33xixfkobzicneifedq._file
Verdict:
unknown
Similar samples:
01678f0b037b244a527b964aa9c32c5f7f554cbfb77305747cf42d5019775d4d
18e57acc198a3afad96f6fff17a0cc538da02afcba38036dda6cf1b8902efd2b
27b5e52c0c575a9d1a1e460ee54fc4f411fd5783b886854d332253c4ff80c51e
3984f829f5857c513de4b0c89a2e4ccc31e05f19100d575714471d0657b5734d
4296080a2384f70638c544c1a4d598035cb895e7346080960df2413510e0c04a
881b7822da80cffa41cc1c6211f554a42ee4ea92340cbdd1d51df9d20a193b03
c86e30382131951485a3f60819910ce781f1a2fd55967c1565a74861e3026815
db1d955d0078b3742f10f891b52782101b01a32061cbf250ccdeb1f02beae663
eed25e577021fe8f43b3b78c7ce7bd0ec0087fd53258536f262533d0cae4177f
ffb318a5fd569396377f80259fb3b2ff02ef492efa1922ccbdd1bcdf1f43c162
+ 93 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence upx
Link:
https://tria.ge/reports/230213-j3bs9abc6v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Adds Run key to start application
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/4ab10d52e602bf25abe1f7907182dda6df5f75aa06f7745caa70728134882907

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/364871/

Comments