MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4eba421dcb1114fb978da0b2387681db29daea8d9b16e29beec2e807a8c10d52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4eba421dcb1114fb978da0b2387681db29daea8d9b16e29beec2e807a8c10d52
SHA3-384 hash: 9e0f6689dec59dbc6b7eaf69e34bc8f6b2d3b2e0ab7cdd7f7933dc7fa19a81e889a5bb9e6606c801b9453adc78f460ee
SHA1 hash: 608d812c6956ffc783fbd4226c2018e68e5d796f
MD5 hash: 3a1662a9941295dfff37e59a0cfc89c2
humanhash: north-burger-hydrogen-william
File name:SecuriteInfo.com.Trojan.DownLoader29.60837.11964.9143
Download: download sample
File size:2'251'776 bytes
First seen:2022-04-21 15:13:05 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash f7ac28d1b20db91e8844beffb4d4a24e
ssdeep 24576:J+nQP/ebfxnM3WYQ7XPZGl2xZEgTnR3coBB9SDR2/lqaJX1JkGQ+:Mw/eZBnlpB3SDg/ZX1SGQ+
Threatray 26 similar samples on MalwareBazaar
TLSH T114A55C13B784663FC4AB0A3B8567A654D83F6B616A16DC4F47F40C4C8F391452E3AA2F
TrID 55.9% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
14.1% (.EXE) Win64 Executable (generic) (10523/12/4)
8.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.0% (.EXE) Win32 Executable (generic) (4505/5/1)
4.0% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
Reporter SecuriteInfoCom
Tags:dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
208
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/265508/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader29.60837.11964.9143.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Dealply-6619238-0
Create hunting rule

PUA.Win.Adware.Dealply-6888374-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
clipbanker control.exe dealply expand.exe greyware keylogger replace.exe virus
Link:
https://www.filescan.io/uploads/626174bdffe27d511924d48a/reports/58588252-1522-4f66-8a09-8c560fb32450/overview
Malware family:
SpyBanker
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cd9696d8-8b27-4712-9b2a-a7ffe2b16931
Result
Threat name:
Deal Ply
Create hunting rule
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/980883
Signature
Antivirus / Scanner detection for submitted sample
Creates autostart registry keys with suspicious values (likely registry only malware)
Multi AV Scanner detection for submitted file
Rundll32 performs DNS lookup (likely malicious behavior)
Sigma detected: Suspicious Call by Ordinal
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 613369 Sample: SecuriteInfo.com.Trojan.Dow... Startdate: 21/04/2022 Architecture: WINDOWS Score: 84 37 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->37 39 Antivirus / Scanner detection for submitted sample 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Sigma detected: Suspicious Call by Ordinal 2->43 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 1 7 8->10         started        14 rundll32.exe 8->14         started        16 rundll32.exe 8->16         started        18 2 other processes 8->18 dnsIp5 35 carrodapamonha-ml.umbler.net 10->35 45 System process connects to network (likely due to code injection or exploit) 10->45 47 Creates autostart registry keys with suspicious values (likely registry only malware) 10->47 49 Rundll32 performs DNS lookup (likely malicious behavior) 10->49 20 WerFault.exe 9 14->20         started        23 WerFault.exe 14->23         started        25 WerFault.exe 3 9 16->25         started        27 WerFault.exe 16->27         started        29 rundll32.exe 18->29         started        signatures6 process7 dnsIp8 33 192.168.2.1 unknown unknown 20->33 31 WerFault.exe 22 9 29->31         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4eba421dcb1114fb978da0b2387681db29daea8d9b16e29beec2e807a8c10d52/
Threat name:
Win32.Adware.DealPly
Create hunting rule
Status:
Malicious
First seen:
2019-08-08 03:50:22 UTC
File Type:
PE (Dll)
Extracted files:
15
AV detection:
19 of 42 (45.24%)
Threat level:
  1/5
Verdict:
malicious
Similar samples:
15a23e5e766596dbc471b4e4afa49316c141a8ee981194c0508f73b0a7f2ccf0
6122924f2393d69b3d9c563736b33ca5182023d9d26c17edd34926ce1f844d7b
7c42542ebefa3aa55190c1a099b75215cded42548a2f11cccf435e9a75179cd1
86aab09b278fe8e538d8cecd28f2d7a32fe413724d5ee52e2815a3267a988595
a0ac775ecbfa0ab3218e32b09a0d4fdcd82e7ceaa31241dc106c4fc77e9b5ddb
bd8d1264a88d5cdd701a4ee909b70beaec39d216c988b33bfb30f25aee3540ee
bf72cee251615ca0af6b861fd4abf781b007249d3b0bc8612bcb37bac0d427f5
ea077019bc7eed24cd45cf0e7b78d8a90ee8a7b8e6a7c7e994d1f62954d00c39
f47aa759b6985d82784847fe10c3062befa65bd18fb9224f4bb625317e6d717e
+ 16 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220421-sma2fsbbek/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
fdfb07b2bcddeff508967c147dd885b5801d988dc756e4b6a0e00be2779b6cc8
MD5 hash:
b0f9e8e798548ee68731d0431f384836
SHA1 hash:
d33624ce452f172619a5f9793914eb22c1b7aa54
Link:
https://www.unpac.me/results/2ee1641d-fb7d-4114-9723-d5ab71cd21c3/
SH256 hash:
4eba421dcb1114fb978da0b2387681db29daea8d9b16e29beec2e807a8c10d52
MD5 hash:
3a1662a9941295dfff37e59a0cfc89c2
SHA1 hash:
608d812c6956ffc783fbd4226c2018e68e5d796f
Link:
https://www.unpac.me/results/2ee1641d-fb7d-4114-9723-d5ab71cd21c3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4eba421dcb1114fb978da0b2387681db29daea8d9b16e29beec2e807a8c10d52

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/265508/

Comments