MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b43870c6b65e05789acb91fad8e94c8b8d3624cb8424e0a99abeca2be7020d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	4b43870c6b65e05789acb91fad8e94c8b8d3624cb8424e0a99abeca2be7020d9
SHA3-384 hash:	2c90f71b223bfc442fd12fd0da336bdd02c8f6aa98229b0060ff0b598d47fc4a24b8c41f5ba67e3a329a6b7ed5c2eae6
SHA1 hash:	95052c732f221d1b9a17d8d40ee2422f39692fb1
MD5 hash:	3694f60aea7ad42b21f71f1b6be7265e
humanhash:	edward-yankee-xray-football
File name:	PO#198945.exe
Download:	download sample
File size:	625'152 bytes
First seen:	2022-06-14 15:17:49 UTC
Last seen:	2022-06-14 16:30:30 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'470 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:y2iNeHqg3NiAmHzB2AP/Ex5h3C21x4Vj7o4PFVD6DbsbjQtFxeKGO7:y1cHHm92AXEly2QVj7ZQ
Threatray	2'804 similar samples on MalwareBazaar
TLSH	T1ACD47BAC362C75DEC857C572EAA81C64EA6434BFA35B5113942315DEAE4CB87CF240F2
TrID	69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.9% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	GovCERT_CH
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

233

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

PO#198945.exe

Verdict:

Suspicious activity

Analysis date:

2022-06-14 21:12:22 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/23753072-8694-4644-97af-290e4e78e2ba

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/279867/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a window

Searching for synchronization primitives

Launching a process

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/62a8a6ef96efd87b05f86b04/reports/1a9c83b6-714d-443a-8352-ca896baba6dc/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/90e7ef65-c84c-44a2-823e-bcfaa60be81e

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1013054

Signature

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4b43870c6b65e05789acb91fad8e94c8b8d3624cb8424e0a99abeca2be7020d9/

Threat name:

ByteCode-MSIL.Trojan.Tnega

Status:

Malicious

First seen:

2022-06-14 10:47:43 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 40 (65.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jnbyoddlmxqfpcnmxep23duuzc4ngysmxbbe4cuzvpwkfptqedmq._file

Verdict:

malicious

37a192054be028fdfc82f70ea2763155a3b4f46b64ea2970ad044b39f00f4d06

56288de1614c45a260868392454f459af7f99d1d9b1d2d0aa07bb88c63412a19

77d8b86738c752ab77f79106aab74b11253cfa84fbcc3bb09de4b7c28276a33d

7e08756edb336543ee9414c648c8c5d11f8d2905f8cea811a862a6b5368fd365

842a75ab92773e52741160c011f7265b489d57d82bdb8e1e6a5582b8852d8f3d

bcef0bbd417cc4000f2d11acb13093d59025d065abaac8ed975c6cbcf8c622d9

c0134614426b3660216aeeb9e1f63af3bac3e941fe3341654190cc0d860f37d1

+ 2'794 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/220614-spk97sbbc4/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Unpacked files

SH256 hash:

79823e47436e129def4fba8ee225347a05b7bb27477fb1cc8be6dc9e9ce75696

MD5 hash:

39f524c1ab0eb76dfd79b2852e5e8c39

SHA1 hash:

428018e1701006744e34480b0029982a76d8a57d

Link:

https://www.unpac.me/results/6f7c6e6e-c412-4491-9b0b-71f933baf9e8/

SH256 hash:

4b43870c6b65e05789acb91fad8e94c8b8d3624cb8424e0a99abeca2be7020d9

MD5 hash:

3694f60aea7ad42b21f71f1b6be7265e

SHA1 hash:

95052c732f221d1b9a17d8d40ee2422f39692fb1

Link:

https://www.unpac.me/results/6f7c6e6e-c412-4491-9b0b-71f933baf9e8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.58

Link:

https://yomi.yoroi.company/submissions/4b43870c6b65e05789acb91fad8e94c8b8d3624cb8424e0a99abeca2be7020d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.