MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5
SHA3-384 hash:	474a45eefc68e5fa16038c0ebf5e9443fb7d715376194d19c2b1f38aa9ec2ef6920a2eb8a89e32aa93d1cfc0aba08b9c
SHA1 hash:	5a4dfdfc3917a92211238416a26f90020a82e097
MD5 hash:	3c8e011554bfacd3f35147de51453451
humanhash:	lima-lamp-aspen-violet
File name:	3c8e011554bfacd3f35147de51453451.exe
Download:	download sample
File size:	1'969'965 bytes
First seen:	2023-10-16 08:14:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7a5e2524b66da5177b4ec46d305a3dd7 (1 x WallStealer, 1 x ChromElevator, 1 x RustyStealer)
ssdeep	49152:ISRFKsZFBqWRSjDlcMDxjjP3x3IVpcxUlTa8G44gwfQ9914WwKGTTW8:ISvK8qWj6ZxYchZfLWwrW8
Threatray	13 similar samples on MalwareBazaar
TLSH	T14C95336A09893E82D55A777153D3535068F982E5F3351F6BC3F5A88DBA1CE080BF21AC
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	848c5454baf46e68 (1 x PrivateLoader)
Reporter	abuse_ch
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

265

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

3c8e011554bfacd3f35147de51453451.exe

Verdict:

Malicious activity

Analysis date:

2023-10-16 08:21:15 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3bb7c5e4-784c-40b4-9b02-5ca64d05cb74

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/454746/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.Evo-gen.16164.21160.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Running batch commands

Launching a process

Creating a process with a hidden window

Dragonfly

Gathering data

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

control installer lolbin lolbin overlay packed packed setupapi sfx shell32 zusy

Link:

https://www.filescan.io/uploads/652cf10a853e4f06480be1a1/reports/392e1c05-caae-4125-a788-60e3d189f93f/overview

Hybrid Analysis Trojan.Zenpak

Verdict:

Malicious

Labled as:

Trojan.Zenpak

Link:

https://www.hybrid-analysis.com/sample/4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e026777d-b63b-45a8-aadb-41e3f2765c46

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1326266

Signature

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-10-15 08:31:49 UTC

File Type:

PE (Exe)

Extracted files:

9

AV detection:

15 of 38 (39.47%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j2qgjja57zq5klgcrwia5tnr643q434wrkdpinde754ceavioh2q._file

Threatray malicious

Verdict:

malicious

Similar samples:

05c8155ca202fde24ee1867e9defa0866b61e6530390922390692f5631b40546

2157d146a890d32c5ba49f31fa1840e5b0d56e4dd0bbf5f8b14cc4e482a47bef

2ce06ea838ff7987486eb638d2d2286b63b7ed6b27076ac528e31b5385f07106

5a0bc27fec2afd25a8e6c57fbd33e4696c533e3b7edba10124407c5b43b2a3d7

5d10fb2c0111b965b922e476c0b54d418855eda85e71757c7a61e77cc2b39eba

727f201106a64bcd465d0e4476424081fc30fa4bf628d7b02bd80ac0b7160c99

9e420f168e28b6b2c3b3da6f655080f158c1d2ab965e5bb13083560fcc2c99b9

d7017c00a3d60ff9c05f3a83e9694dd51c929ecdd1d339b9840c68bb8bce5e1a

d74686c87f0777d1e8c4fcc18b40fe3ce97d6e531e23b6665037e5599b72aa32

ec6afcb293fcdccc66eaa852e9ca99f6d149561553eeafa14b23d64f9c939407

+ 3 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/231016-j5kh6scg5v/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

f13e42d91ffb74618a59dfa3647e01dae5ce5522c6fd225fb4b5dfa794a3fc5b

MD5 hash:

94879b864de0a7ab1285c065d2a1a1a6

SHA1 hash:

f887173b1a698be1dfb6b73a78b7f673f20ec34e

Link:

https://www.unpac.me/results/76a203b5-c4e3-4bf8-8e1b-66045d6ad7a7/

SH256 hash:

4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5

MD5 hash:

3c8e011554bfacd3f35147de51453451

SHA1 hash:

5a4dfdfc3917a92211238416a26f90020a82e097

Link:

https://www.unpac.me/results/76a203b5-c4e3-4bf8-8e1b-66045d6ad7a7/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.19

Link:

https://yomi.yoroi.company/submissions/4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 4ea064a41dfe61d52cc28d900ecdb1f7370e6f968a86f43464ff782202a871f5

(this sample)

Cape

https://www.capesandbox.com/analysis/454746/

  

URLhaus

https://urlhaus.abuse.ch/url/2715154/

  

Delivery method

Distributed via web download