MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4eeeac2b172af8bd424644ca260c9bebf8ebc075d5172b3ff3cf5a8c7b80442e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4eeeac2b172af8bd424644ca260c9bebf8ebc075d5172b3ff3cf5a8c7b80442e
SHA3-384 hash: 17f95393e9f26bd06a7293bf4d4dff69f1f3e90f88199614d5735988169ad11575b51494550249cb3424e986a8e882a5
SHA1 hash: 5f09e497232fb7bfec6bce9e6dc4f0db26bdf9ff
MD5 hash: c83660f004aeea94f057ade9c2455c60
humanhash: hotel-spaghetti-kentucky-lithium
File name:SecuriteInfo.com.W64.Trojan.GKA.gen.Eldorado.28037.23063
Download: download sample
File size:16'003'600 bytes
First seen:2024-10-27 18:29:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 96ffa1b56e0e67a5207f0c06088e1c9e
ssdeep 196608:JDfipBJl/uY1f07FSdYQVIWxhnKNTPy02x6TkJbYcOy8eZqJEZoRUrkPT3dyDt5e:QSgdxxxhKo020gJbYcxO7PTtz6JDN4I0
TLSH T169F6333EFB66B061CBCA3DF85E11611A1AF47A67B990DFCD4409AA1DC93A3F46414E03
TrID 45.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.3% (.EXE) OS/2 Executable (generic) (2029/13)
18.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.0% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
759
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W64.Trojan.GKA.gen.Eldorado.28037.23063.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=671e86b9a75e41aa67227253
Tags:
Packed
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lolbin microsoft_visual_cc packed packed packer_detected shell32 themidawinlicense
Link:
https://www.filescan.io/uploads/671e86b0dc0f612080023024/reports/92a9463e-b78d-44e4-b438-eaa85ee1447a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/4eeeac2b172af8bd424644ca260c9bebf8ebc075d5172b3ff3cf5a8c7b80442e
Result
Verdict:
UNKNOWN
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/ae671aae-b8e7-45ad-a54b-acfd4d3a28bf
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1543382
Signature
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade debugger and weak emulator (self modifying code)
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4eeeac2b172af8bd424644ca260c9bebf8ebc075d5172b3ff3cf5a8c7b80442e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4eeeac2b172af8bd424644ca260c9bebf8ebc075d5172b3ff3cf5a8c7b80442e/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j3xkykyxfl4l2qsgitfcmde35p4oxqdv2ulswp7tz5niy64aiqxa._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion themida trojan
Link:
https://tria.ge/reports/241027-w5ghqszhpd/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks whether UAC is enabled
Checks BIOS information in registry
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/056a48ad-ab78-4a05-b241-d3b73d8f9238
Unpacked files
SH256 hash:
4eeeac2b172af8bd424644ca260c9bebf8ebc075d5172b3ff3cf5a8c7b80442e
MD5 hash:
c83660f004aeea94f057ade9c2455c60
SHA1 hash:
5f09e497232fb7bfec6bce9e6dc4f0db26bdf9ff
Link:
https://www.unpac.me/results/76e57832-6d1d-4e23-b045-66e8a31f7118/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/4eeeac2b172af8bd424644ca260c9bebf8ebc075d5172b3ff3cf5a8c7b80442e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:pe_detect_tls_callbacks
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 4eeeac2b172af8bd424644ca260c9bebf8ebc075d5172b3ff3cf5a8c7b80442e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3258152/
  
Delivery method
Distributed via web download

Comments