MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4bc13d2eb3e05dfa83c292d05bbcfeb0201f385c59e22a2eede6beb1df384586. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4bc13d2eb3e05dfa83c292d05bbcfeb0201f385c59e22a2eede6beb1df384586
SHA3-384 hash: fae1fd5f44273d12b4fe3ebcac8771c58eee32446a79fdb0ca87a7384ec25128fb79ca3254d282a910fc1889ea65e716
SHA1 hash: 1abbab058c89f823d8ef2616ce6f9260f48d43fd
MD5 hash: 855d14c3666d2c2696b2c1cf39d788fd
humanhash: july-oxygen-two-cardinal
File name:SecuriteInfo.com.Win64.TrojanX-gen.6160.2539
Download: download sample
File size:1'174'528 bytes
First seen:2024-06-19 01:18:52 UTC
Last seen:2024-06-19 13:06:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:ExrYcvryCx+pEk28M0g8OhBdAJVzgxUSxi1KsHAZaW7Ww9j+6sF0ZWPKmIFhlyZq:Ox+h+uwsF0Z7F3SZpbOoWqc5C19
Threatray 132 similar samples on MalwareBazaar
TLSH T1F1455D1439FA5119F073AFF35BEBF5A64B7AF5A22509E469248213C74722F40CD81A3B
TrID 56.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
330
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4bc13d2eb3e05dfa83c292d05bbcfeb0201f385c59e22a2eede6beb1df384586.exe
Verdict:
No threats detected
Analysis date:
2024-06-19 01:21:54 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1999c933-99c1-41d5-8064-027b963f9925

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win64.TrojanX-gen.6160.2539.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=667233d60f8138dd4eaea730win7simulatehigh_evasion
Tags:
Generic Static
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Searching for synchronization primitives
Creating a file
Launching the default Windows debugger (dwwin.exe)
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade vbnet
Link:
https://www.filescan.io/uploads/6672320721581a92819dd2d6/reports/b536157d-9f82-430c-acd0-68d44512eb95/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/4bc13d2eb3e05dfa83c292d05bbcfeb0201f385c59e22a2eede6beb1df384586
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2d381ede-1667-44b9-943f-66b148375ed9
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1459241
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large strings
AI detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4bc13d2eb3e05dfa83c292d05bbcfeb0201f385c59e22a2eede6beb1df384586
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4bc13d2eb3e05dfa83c292d05bbcfeb0201f385c59e22a2eede6beb1df384586/
Threat name:
ByteCode-MSIL.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2024-06-19 01:19:08 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
14
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jpat2lvt4bo7va6cslifxph6waqb6oc4lhrculxn427ldxzyiwda._file
Verdict:
unknown
Similar samples:
38b54504db439c0030ef442f4f623ff014756f820480c09857bf780c3a195d58
3bde841da7cf2130597faadcbf6f472787e66af4651596d1a200988df107abdd
4bc13d2eb3e05dfa83c292d05bbcfeb0201f385c59e22a2eede6beb1df384586
8019ad825c81ba5c7c447148f0d7f8034c6c2b48bf92a448e72983b593fa7319
e6f4eca972e3ce795f560a37520cdd9e7eed8dd383fb5bf0d1959faf6d12d916
+ 122 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240619-bphqms1cnc/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/cf717f47-b83e-4a47-aee4-7bd055a041b5
Unpacked files
SH256 hash:
4bc13d2eb3e05dfa83c292d05bbcfeb0201f385c59e22a2eede6beb1df384586
MD5 hash:
855d14c3666d2c2696b2c1cf39d788fd
SHA1 hash:
1abbab058c89f823d8ef2616ce6f9260f48d43fd
Link:
https://www.unpac.me/results/28c44e29-c849-456f-af85-7bd72d9f5b58/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4bc13d2eb3e0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar 5be0a2cfc859bb18a935ba8842e508a59cf465c6550be35e8d9a0470c40a729f

Executable exe 4bc13d2eb3e05dfa83c292d05bbcfeb0201f385c59e22a2eede6beb1df384586

(this sample)

  
Dropped by
SHA256 5be0a2cfc859bb18a935ba8842e508a59cf465c6550be35e8d9a0470c40a729f
  
Dropped by
MD5 24b324f0b94c90548b0df4cd5d63e08a

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments