MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5
SHA3-384 hash: 474a45eefc68e5fa16038c0ebf5e9443fb7d715376194d19c2b1f38aa9ec2ef6920a2eb8a89e32aa93d1cfc0aba08b9c
SHA1 hash: 5a4dfdfc3917a92211238416a26f90020a82e097
MD5 hash: 3c8e011554bfacd3f35147de51453451
humanhash: lima-lamp-aspen-violet
File name:3c8e011554bfacd3f35147de51453451.exe
Download: download sample
File size:1'969'965 bytes
First seen:2023-10-16 08:14:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7a5e2524b66da5177b4ec46d305a3dd7
ssdeep 49152:ISRFKsZFBqWRSjDlcMDxjjP3x3IVpcxUlTa8G44gwfQ9914WwKGTTW8:ISvK8qWj6ZxYchZfLWwrW8
Threatray 13 similar samples on MalwareBazaar
TLSH T14C95336A09893E82D55A777153D3535068F982E5F3351F6BC3F5A88DBA1CE080BF21AC
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10523/12/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 848c5454baf46e68 (1 x PrivateLoader)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
265
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3c8e011554bfacd3f35147de51453451.exe
Verdict:
Malicious activity
Analysis date:
2023-10-16 08:21:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3bb7c5e4-784c-40b4-9b02-5ca64d05cb74

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/454746/
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.16164.21160.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Running batch commands
Launching a process
Creating a process with a hidden window
Gathering data
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control installer lolbin lolbin overlay packed packed setupapi sfx shell32 zusy
Link:
https://www.filescan.io/uploads/652cf10a853e4f06480be1a1/reports/392e1c05-caae-4125-a788-60e3d189f93f/overview
Verdict:
Malicious
Labled as:
Trojan.Zenpak
Link:
https://www.hybrid-analysis.com/sample/4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e026777d-b63b-45a8-aadb-41e3f2765c46
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1326266
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1326266 Sample: X3uhpRmWuE.exe Startdate: 16/10/2023 Architecture: WINDOWS Score: 64 27 Multi AV Scanner detection for dropped file 2->27 29 Multi AV Scanner detection for submitted file 2->29 31 Machine Learning detection for sample 2->31 33 Machine Learning detection for dropped file 2->33 10 X3uhpRmWuE.exe 4 2->10         started        process3 file4 25 C:\Users\user\AppData\Local\Temp\...\BsaTBY.4, PE32 10->25 dropped 13 cmd.exe 1 10->13         started        process5 process6 15 control.exe 1 13->15         started        17 conhost.exe 13->17         started        process7 19 rundll32.exe 15->19         started        process8 21 rundll32.exe 19->21         started        process9 23 rundll32.exe 21->23         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-10-15 08:31:49 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j2qgjja57zq5klgcrwia5tnr643q434wrkdpinde754ceavioh2q._file
Verdict:
malicious
Similar samples:
05c8155ca202fde24ee1867e9defa0866b61e6530390922390692f5631b40546
2157d146a890d32c5ba49f31fa1840e5b0d56e4dd0bbf5f8b14cc4e482a47bef
2ce06ea838ff7987486eb638d2d2286b63b7ed6b27076ac528e31b5385f07106
5a0bc27fec2afd25a8e6c57fbd33e4696c533e3b7edba10124407c5b43b2a3d7
5d10fb2c0111b965b922e476c0b54d418855eda85e71757c7a61e77cc2b39eba
727f201106a64bcd465d0e4476424081fc30fa4bf628d7b02bd80ac0b7160c99
9e420f168e28b6b2c3b3da6f655080f158c1d2ab965e5bb13083560fcc2c99b9
d7017c00a3d60ff9c05f3a83e9694dd51c929ecdd1d339b9840c68bb8bce5e1a
d74686c87f0777d1e8c4fcc18b40fe3ce97d6e531e23b6665037e5599b72aa32
ec6afcb293fcdccc66eaa852e9ca99f6d149561553eeafa14b23d64f9c939407
+ 3 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231016-j5kh6scg5v/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Unpacked files
SH256 hash:
f13e42d91ffb74618a59dfa3647e01dae5ce5522c6fd225fb4b5dfa794a3fc5b
MD5 hash:
94879b864de0a7ab1285c065d2a1a1a6
SHA1 hash:
f887173b1a698be1dfb6b73a78b7f673f20ec34e
Link:
https://www.unpac.me/results/76a203b5-c4e3-4bf8-8e1b-66045d6ad7a7/
SH256 hash:
4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5
MD5 hash:
3c8e011554bfacd3f35147de51453451
SHA1 hash:
5a4dfdfc3917a92211238416a26f90020a82e097
Link:
https://www.unpac.me/results/76a203b5-c4e3-4bf8-8e1b-66045d6ad7a7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.19
Link:
https://yomi.yoroi.company/submissions/4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/454746/
  
URLhaus
https://urlhaus.abuse.ch/url/2715154/
  
Delivery method
Distributed via web download

Comments