MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f8d6ffadd35a07194cc2739873ef459f246b5aeff1d88b5b10fe34887d4a786. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.Generic


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f8d6ffadd35a07194cc2739873ef459f246b5aeff1d88b5b10fe34887d4a786
SHA3-384 hash: edf4cd54a0ee9c23da933ae4601c96f04d023a17e06d1f025da4d77a20c4f45b0c22ee9b8f0a9ea909db05a74a314a12
SHA1 hash: c8ce9af0638f2b5d6c9de3267df1923650530034
MD5 hash: 428e3a4fddf197200a876b47e2592daa
humanhash: jupiter-gee-kentucky-island
File name:file
Download: download sample
Signature Adware.Generic
Create hunting rule
File size:1'564'696 bytes
First seen:2023-02-27 16:28:31 UTC
Last seen:2023-02-27 18:30:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 02e28361a03cf60be52270f54ba9d56d (1 x Adware.Generic, 1 x GCleaner, 1 x Rhadamanthys)
ssdeep 24576:kWNUeHUWdsfUta2Vgs2r7zBtezySdevOh3euwFclNeAesaWg8ydYnNv:kWNUeHUWEUdgzr7z2Td4OReukcTaW7yQ
Threatray 225 similar samples on MalwareBazaar
TLSH T1F475E127A07ABA17E8C319737101623F75B6B7F88EFBBE93D08257940C40BD541D962A
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9761c993a5cc312f (1 x Adware.Generic)
Reporter jstrosch
Tags:Adware.Generic exe signed

Code Signing Certificate

Organisation:*.good.com
Issuer:DigiCert TLS RSA SHA256 2020 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2022-07-21T00:00:00Z
Valid to:2023-08-21T23:59:59Z
Serial number: 04e579c67f83c6f9036e31614e489747
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 29099e03d6aa96fef035970e92f054d2d3c33031b75b4a2c9b56cbb84cde68da
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
251
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Suspicious activity
Analysis date:
2023-02-27 16:57:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/65876d89-91bb-472c-8fb9-08cffe6defbd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/370348/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.6327.17201.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Launching a process
Creating a file in the %temp% directory
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Detecting VM
Sending an HTTP GET request
Reading critical registry keys
Creating a process with a hidden window
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/63fcda57589e1e4c5bd99c76/reports/8612e1ac-dfc9-4b9e-918c-49747672754e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/4f8d6ffadd35a07194cc2739873ef459f246b5aeff1d88b5b10fe34887d4a786
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Mustang Panda
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d8a4c256-8fa0-41ff-8572-13373d514c48
Result
Threat name:
RHADAMANTHYS, lgoogLoader
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1183366
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Checks if the current machine is a virtual machine (disk enumeration)
Contain functionality to detect virtual machines
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to hide a thread from the debugger
Early bird code injection technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Found potential ransomware demand text
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Queues an APC in another process (thread injection)
Searches for specific processes (likely to inject)
Sigma detected: Dot net compiler compiles file from suspicious location
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected lgoogLoader
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 816235 Sample: file.exe Startdate: 27/02/2023 Architecture: WINDOWS Score: 100 69 Snort IDS alert for network traffic 2->69 71 Multi AV Scanner detection for dropped file 2->71 73 Multi AV Scanner detection for submitted file 2->73 75 9 other signatures 2->75 10 file.exe 9 2->10         started        process3 dnsIp4 61 az2wfeutrm.6m44ug6ftb6he37vc9qu 10->61 51 C:\Users\user\AppData\Local\...\5879171.dll, PE32 10->51 dropped 85 Writes to foreign memory regions 10->85 87 Allocates memory in foreign processes 10->87 89 Injects a PE file into a foreign processes 10->89 15 fontview.exe 10->15         started        18 WerFault.exe 2 9 10->18         started        22 WerFault.exe 24 9 10->22         started        24 ngentask.exe 10->24         started        file5 signatures6 process7 dnsIp8 91 Query firmware table information (likely to detect VMs) 15->91 93 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 15->93 95 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->95 97 11 other signatures 15->97 26 dllhost.exe 15->26         started        59 192.168.2.1 unknown unknown 18->59 45 C:\ProgramData\Microsoft\...\Report.wer, Unicode 18->45 dropped 47 C:\ProgramData\Microsoft\...\Report.wer, Unicode 22->47 dropped file9 signatures10 process11 signatures12 77 Early bird code injection technique detected 26->77 79 Tries to harvest and steal browser information (history, passwords, etc) 26->79 81 Maps a DLL or memory area into another process 26->81 83 Queues an APC in another process (thread injection) 26->83 29 dllhost.exe 7 24 26->29         started        process13 dnsIp14 63 185.246.220.34, 443, 49717, 49719 LVLT-10753US Germany 29->63 53 C:\Users\user\AppData\...CXcWuAtNs.exe, PE32+ 29->53 dropped 55 C:\Users\user\AppData\...\CiMjVKxTUq.exe, PE32+ 29->55 dropped 57 C:\Users\user\AppData\...\m5lqjtkw.cmdline, Unicode 29->57 dropped 33 ECXcWuAtNs.exe 2 29->33         started        36 CiMjVKxTUq.exe 29->36         started        38 csc.exe 3 29->38         started        file15 process16 file17 65 Antivirus detection for dropped file 33->65 67 Machine Learning detection for dropped file 33->67 49 C:\Users\user\AppData\Local\...\m5lqjtkw.dll, PE32 38->49 dropped 41 conhost.exe 38->41         started        43 cvtres.exe 1 38->43         started        signatures18 process19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f8d6ffadd35a07194cc2739873ef459f246b5aeff1d88b5b10fe34887d4a786/
Threat name:
Win32.Trojan.Strab
Create hunting rule
Status:
Malicious
First seen:
2023-02-27 16:29:11 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j6gw76w5gwqhdfgme44yopxulhzennno74oyrnnrb7rurb6uu6da._file
Verdict:
malicious
Similar samples:
115b0ce460a286cc2cbe886befaf3a588421ffff276194a35a94a102b43e2943
Adware.Generic
248cc9a72ef0f0740bd05bf10b56345530e820a2179ccf295722cd85667ee8c1
Adware.Generic
295235e40ca5515045169bb0ca2730dd9ee2c06927df750a887018812f5cef48
Adware.Generic
5f41ff61fd5b5b8596e8912be5299f855251ec7af961740a752f09cf4a6cb67a
Adware.Generic
943ba4a6b708cc1c79323f7c2b255cc57e7f788cabd6cdb13146c4fcb145b425
Adware.Generic
b2842c5a354d92ad4ae55a788519408ed4acc2b26cd068fb636596d6f3741c9c
Adware.Generic
db9c2f019ca91a2166740431d64d02bfff97a9638e68e9858fb9616f2df371ea
Adware.Generic
e09f0bd79308d5a35381b2921ca5f0f609225120157de3d093554eb4b611839e
Adware.Generic
+ 215 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:lgoogloader family:rhadamanthys downloader stealer
Link:
https://tria.ge/reports/230227-ty883aee88/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Loads dropped DLL
Detect rhadamanthys stealer shellcode
Detects LgoogLoader payload
LgoogLoader
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
cf34a785af41d6eadea9033ea426c8b989ec3a2994d4fc4d5e395155da43518a
MD5 hash:
710f391f59254798ebfcc8e9376604f7
SHA1 hash:
74173b7cafe1b75a6d5b75fd1210a2cd9f244bfa
Link:
https://www.unpac.me/results/589de96e-e62c-47f1-89f9-0c67efaec2a2/
SH256 hash:
4f8d6ffadd35a07194cc2739873ef459f246b5aeff1d88b5b10fe34887d4a786
MD5 hash:
428e3a4fddf197200a876b47e2592daa
SHA1 hash:
c8ce9af0638f2b5d6c9de3267df1923650530034
Link:
https://www.unpac.me/results/589de96e-e62c-47f1-89f9-0c67efaec2a2/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4f8d6ffadd35/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/4f8d6ffadd35a07194cc2739873ef459f246b5aeff1d88b5b10fe34887d4a786

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Adware.Generic

Executable exe 4f8d6ffadd35a07194cc2739873ef459f246b5aeff1d88b5b10fe34887d4a786

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/370348/

Comments