MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d9e0a28423515a1574837873cc75c3c495daebf2247e5353f9028d97ccf3fb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4d9e0a28423515a1574837873cc75c3c495daebf2247e5353f9028d97ccf3fb6
SHA3-384 hash:	1c81e2074dac02a94529330d6e55cdbe7ce4ea2f940229d551812903baa36f33f680d5526f7a2aa659e4de5afecc047d
SHA1 hash:	b4b0f82dfc031011429b95fedc7a49439acb4388
MD5 hash:	be00826617f474f9de3a27f7d3e42a54
humanhash:	delta-don-pizza-indigo
File name:	be00826617f474f9de3a27f7d3e42a54.exe
Download:	download sample
File size:	871'936 bytes
First seen:	2023-06-13 10:20:52 UTC
Last seen:	2023-06-13 15:42:05 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	12288:qSMpcSxyaSrUsMePCjtQ/fKv3Q3mBnJPy3:YA32y3
Threatray	1 similar samples on MalwareBazaar
TLSH	T12605B3807054E510E9AC32F65C39D4D4132ABF6A2C00D356B8F8BBEEAC75617CE5726E
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	abuse_ch
Tags:	exe

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

251

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

be00826617f474f9de3a27f7d3e42a54.exe

Verdict:

Malicious activity

Analysis date:

2023-06-13 10:25:46 UTC

Tags:

opendir gcleaner loader

Link:

https://app.any.run/tasks/69872912-2d0f-4c26-9ff3-d4e2aecd3870

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/398224/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win64.WormX-gen.3764.17990.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a file

Creating a service

Launching a service

Loading a system driver

Creating a file in the Windows subdirectories

Creating a file in the Windows directory

Launching a process

Enabling autorun for a service

Forced shutdown of a system process

Sending an HTTP GET request to an infection source

Unauthorized injection to a system process

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/648843149f45f940f553c288/reports/3c6e11a3-d101-42f9-b2e7-3a88a1734479/overview

Hybrid Analysis MSIL/GenKryptik_AGeneric.AAK trojan

Verdict:

Malicious

Labled as:

MSIL/GenKryptik_AGeneric.AAK trojan

Link:

https://www.hybrid-analysis.com/sample/4d9e0a28423515a1574837873cc75c3c495daebf2247e5353f9028d97ccf3fb6

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d105ef16-0e60-4976-a464-f15b3df7ef67

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1253526

Signature

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sample is not signed and drops a device driver

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4d9e0a28423515a1574837873cc75c3c495daebf2247e5353f9028d97ccf3fb6/

ReversingLabs TitaniumCloud Win64.Trojan.Privateloader

Threat name:

Win64.Trojan.Privateloader

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-06-13 05:40:54 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

14

AV detection:

19 of 35 (54.29%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jwpaukccguk2cv2ig6dtzr24hrev3lv7ejd6knj7sauns7gph63a._file

Threatray malicious

Verdict:

malicious

Similar samples:

2951ba641cb9cf539b45973fb7d178aaa0b511812b4e84f42dd998cbd8363e2c

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/230613-mdnnasgc6y/

Behaviour

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

UnpacMe

Unpacked files

SH256 hash:

4d9e0a28423515a1574837873cc75c3c495daebf2247e5353f9028d97ccf3fb6

MD5 hash:

be00826617f474f9de3a27f7d3e42a54

SHA1 hash:

b4b0f82dfc031011429b95fedc7a49439acb4388

Link:

https://www.unpac.me/results/b09e4a8e-ed8d-4e78-a87e-0f76e7ce14ab/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4d9e0a284235/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4d9e0a28423515a1574837873cc75c3c495daebf2247e5353f9028d97ccf3fb6

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 4d9e0a28423515a1574837873cc75c3c495daebf2247e5353f9028d97ccf3fb6

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2627614/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/398224/