MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fa67d9abf4edda0e056f8479aa8f2958d775c35d56b558c8e9cefe7c77f6e2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fa67d9abf4edda0e056f8479aa8f2958d775c35d56b558c8e9cefe7c77f6e2f
SHA3-384 hash: a8a3ebd5494cdea25f635da33f8381571f9f081c79f62558b0b7ec9f9ec56b344f7e35cca6ee2a116656524693770e66
SHA1 hash: aa82a77b970d3bdad755e69a75678e2b5121b62b
MD5 hash: ccd63ffad52e86fb7a003a8a254d0a94
humanhash: mango-helium-white-twenty
File name:Unlocker.exe
Download: download sample
File size:396'800 bytes
First seen:2024-04-30 20:14:10 UTC
Last seen:2024-04-30 21:48:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f326f88ca83c9aacaa44acfb8884f1d4 (8 x RedLineStealer, 4 x DCRat, 2 x CoinMiner)
ssdeep 12288:Z5oaqjp/9Tdq0TuBkZEp8TX34p0YDIx0N:Z5v4DTdq0TuBkZU8TAwx0N
Threatray 142 similar samples on MalwareBazaar
TLSH T1BB845B2B37B7440EE25276BACEA0C66CB574B2512A17D35747717EA6EE14BC8DF802C0
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon f07033355c8cccf0
Reporter v4lentine
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
350
Origin country :
SA SA
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4fa67d9abf4edda0e056f8479aa8f2958d775c35d56b558c8e9cefe7c77f6e2f.exe
Verdict:
Malicious activity
Analysis date:
2024-04-30 20:15:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/11c0e0d8-ee54-4a6a-b49c-46ea9bf219a5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33822938.14445.490.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Running batch commands
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lolbin shell32
Link:
https://www.filescan.io/uploads/66315148de9c2e310304e82e/reports/37f42e1f-be9b-4ca4-9ea3-fb60c5944e7d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/4fa67d9abf4edda0e056f8479aa8f2958d775c35d56b558c8e9cefe7c77f6e2f
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4ed17cd0-cb1f-4bfa-ae3b-43de52af3400
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1434341
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1434341 Sample: Unlocker.exe Startdate: 30/04/2024 Architecture: WINDOWS Score: 52 12 Multi AV Scanner detection for submitted file 2->12 14 Machine Learning detection for sample 2->14 6 Unlocker.exe 8 2->6         started        process3 process4 8 cmd.exe 1 6->8         started        10 conhost.exe 6->10         started       
Score:
86%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4fa67d9abf4edda0e056f8479aa8f2958d775c35d56b558c8e9cefe7c77f6e2f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4fa67d9abf4edda0e056f8479aa8f2958d775c35d56b558c8e9cefe7c77f6e2f/
Threat name:
Win64.Hacktool.Unlocker
Create hunting rule
Status:
Malicious
First seen:
2024-02-05 00:15:46 UTC
File Type:
PE+ (Exe)
Extracted files:
4
AV detection:
11 of 38 (28.95%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j6th3gv7j3o2bycw7bdzvkhsswgxoxbv2vvvldeottx6pr37nyxq._file
Verdict:
unknown
Similar samples:
2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2
46fa3d475c4f406890b4c26589c6c937c58813c2ee5a3782621e1b78288e35e9
4fa67d9abf4edda0e056f8479aa8f2958d775c35d56b558c8e9cefe7c77f6e2f
65dee75f5d4f0d7e0c1065a689ebe79f67c87a4d3d9654193164128e859a0ddd
7dda641f8a033f4428d6dc5a37b7c2e141b739683187d6f6a29c906693e85d36
ba59622733f580592e807c44751503149a54f104b593b097dee0d6cd9e314bcc
ea07ac0be9b5d757b3d6eab704606fb022770451be04c729af03f3a0941d3fc8
ebe82a7d2f2f9989a5e4ef6a4602a8224abdff7aef5baa6beacb5977c02ac3e0
f98183a2ad674f8aae6ad47e7da8b48c80175148ba333f0f57b3e6eca64bfaa6
+ 132 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240430-y1j46sfb3z/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
4fa67d9abf4edda0e056f8479aa8f2958d775c35d56b558c8e9cefe7c77f6e2f
MD5 hash:
ccd63ffad52e86fb7a003a8a254d0a94
SHA1 hash:
aa82a77b970d3bdad755e69a75678e2b5121b62b
Link:
https://www.unpac.me/results/29846397-df52-4190-b4c7-988000490323/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4fa67d9abf4edda0e056f8479aa8f2958d775c35d56b558c8e9cefe7c77f6e2f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
MULTIMEDIA_APICan Play MultimediaWINMM.DLL::timeBeginPeriod
SHELL_APIManipulates System ShellSHELL32.DLL::ShellExecuteExW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::SetConsoleCtrlHandler
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::GetSystemDirectoryW
KERNEL32.dll::RemoveDirectoryW
KERNEL32.dll::GetTempFileNameW
WIN_USER_APIPerforms GUI ActionsUSER32.DLL::CreateWindowExW

Comments