MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c380b1c9202405487e7b5926d6c571d7aa2d2db94467aaef78e383f53a768ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 13

Intelligence 13 IOCs YARA 23 File information Comments

SHA256 hash:	4c380b1c9202405487e7b5926d6c571d7aa2d2db94467aaef78e383f53a768ba
SHA3-384 hash:	26ff1194a3125c68074de7c6577d15a9633335526dd2ba85d2df2a0d43b393ef35dfd41e1abef6431e02f8e3e8900e89
SHA1 hash:	6621386884129a70e9a45e4bfbe2a443e513fe74
MD5 hash:	fb28876ec3420794f5817f69e620c607
humanhash:	uniform-aspen-sweet-hamper
File name:	4c380b1c9202405487e7b5926d6c571d7aa2d2db94467aaef78e383f53a768ba
Download:	download sample
File size:	4'202'496 bytes
First seen:	2024-09-12 08:58:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	098ad148a518eebfd3e07f6b553fe198
ssdeep	98304:H5CHnLT9BIZizhI5VJ7HUvyf5t07YcSyb7:QHnlBIZizhUVB0wcr
Threatray	1 similar samples on MalwareBazaar
TLSH	T1DA16AF10720B8067E99313B2195CDBB7857CFD251F7100D7A3E46A6C0DB16C27BBABA6
TrID	68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 12.5% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	JAMESWT_WT
Tags:	209-182-225-110 exe

Intelligence

File Origin

# of uploads :

# of downloads :

387

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

4c380b1c9202405487e7b5926d6c571d7aa2d2db94467aaef78e383f53a768ba

Verdict:

Malicious activity

Analysis date:

2024-09-12 09:01:24 UTC

Tags:

evasion ssload

Link:

https://app.any.run/tasks/6257d8d2-90ba-4509-bf3a-2c35fc21d686

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Malware.PDB-62.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66e2ad58751db35a8b9f7f27

Tags:

Discovery Infostealer Network Static Stealth Agent

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm crypto epmicrosoft_visual_cc evasive fingerprint greyware hacktool lolbin microsoft_visual_cc packed peloader shell32

Link:

https://www.filescan.io/uploads/66e2ad5987af302661ef88d7/reports/4d40ec8c-d65c-4789-93df-162bbdfb904a/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/4c380b1c9202405487e7b5926d6c571d7aa2d2db94467aaef78e383f53a768ba

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/7995ca20-bb43-4eb1-8337-70f887884d3d

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1509943

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

50%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/4c380b1c9202405487e7b5926d6c571d7aa2d2db94467aaef78e383f53a768ba

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4c380b1c9202405487e7b5926d6c571d7aa2d2db94467aaef78e383f53a768ba/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2024-09-10 13:39:04 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jq4awhesajafjb7hwwjg23cxdv5kfuw3srdhvlxxry4d6u5hnc5a._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery

Link:

https://tria.ge/reports/240912-kxqkwszfpr/

Behaviour

System Location Discovery: System Language Discovery

Looks up external IP address via web service

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1a596e76-ba58-47de-8565-d037d0dc5e53

Unpacked files

SH256 hash:

1787c39c32d3a4dcbd50de33831acfae0e8042ea0a7e1cbe04af9bf6a5fdef3e

MD5 hash:

7972b5b43e033ed7b546378e7ba842ba

SHA1 hash:

857f5eb51413daf5d9c68b1e909d4375232e5d34

Link:

https://www.unpac.me/results/c8a3fe6d-9dfb-4217-8156-73060e247e5f/

SH256 hash:

4c380b1c9202405487e7b5926d6c571d7aa2d2db94467aaef78e383f53a768ba

MD5 hash:

fb28876ec3420794f5817f69e620c607

SHA1 hash:

6621386884129a70e9a45e4bfbe2a443e513fe74

Link:

https://www.unpac.me/results/c8a3fe6d-9dfb-4217-8156-73060e247e5f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4c380b1c9202405487e7b5926d6c571d7aa2d2db94467aaef78e383f53a768ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Debugger Create hunting rule

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__GlobalFlags Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_Malicious_VBScript_Base64 Create hunting rule
Author:	daniyyell
Description:	Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::EqualSid ADVAPI32.dll::FreeSid ADVAPI32.dll::GetLengthSid RPCRT4.dll::RpcRevertToSelf ADVAPI32.dll::RevertToSelf
RPC_API	Can Execute Remote Procedures	RPCRT4.dll::RpcAsyncCancelCall RPCRT4.dll::RpcAsyncCompleteCall RPCRT4.dll::RpcAsyncInitializeHandle RPCRT4.dll::RpcBindingFree RPCRT4.dll::RpcBindingFromStringBindingW RPCRT4.dll::RpcBindingToStringBindingW
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::CheckTokenMembership ADVAPI32.dll::DuplicateToken ADVAPI32.dll::GetTokenInformation ADVAPI32.dll::ImpersonateSelf
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessW KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenProcessToken ADVAPI32.dll::OpenThreadToken KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread KERNEL32.dll::CreateThreadpoolWait
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::FindFirstVolumeW KERNEL32.dll::FindNextVolumeW KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileMappingW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileExW SHLWAPI.dll::PathRemoveFileSpecW
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::LookupPrivilegeValueW KERNEL32.dll::QueryDosDeviceW
WIN_CRYPT_API	Uses Windows Crypt API	ADVAPI32.dll::CryptAcquireContextW ADVAPI32.dll::CryptGenRandom
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegNotifyChangeKeyValue ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryInfoKeyW ADVAPI32.dll::RegQueryMultipleValuesW ADVAPI32.dll::RegQueryValueExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample