MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 504f5f18e828012d45b3e559f4414eabbb9cb31f9e4a3e05863077bb90629be4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Intelligence 11 IOCs YARA 6 File information Comments

SHA256 hash:	504f5f18e828012d45b3e559f4414eabbb9cb31f9e4a3e05863077bb90629be4
SHA3-384 hash:	dcf211bc518272ce90f7efb7a9f68945901f8939ea63b38e8274efffeedf261eca05d1664e6d4f566bfc00555b68355d
SHA1 hash:	d60a075e4245efe9b3795bea24f1a47b4776b037
MD5 hash:	766e5fe445153ec0e000de5070643c04
humanhash:	purple-bravo-indigo-winter
File name:	file
Download:	download sample
File size:	2'938'594 bytes
First seen:	2024-09-24 13:32:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep	49152:VIfJWJAxDIq+oRI8Tzws5QIkqMCUPOz0O1v6dGG9ALBB57qegwhEn:VIIJAh+ou8/HWI/MCU2oEv89ALB7qEhS
TLSH	T1D0D53301FAD244B2D4320A328E259B18757C7D292B39DD5BB3DABC2DE2751E0B615F23
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4504/4/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
File icon (PE):
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	jstrosch
Tags:	exe

jstrosch

Found at hxxps://glthub[.]ru/file.exe by #subcrawl

Intelligence

File Origin

# of uploads :

# of downloads :

372

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

No threats detected

Analysis date:

2024-09-24 13:36:31 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/08567e78-e599-4021-a875-c6a4ce79fcaf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Trojan.DarkKomet-10027799-0

SecuriteInfo.com.LuheRARDropper.19200.30796.UNOFFICIAL

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66f2bf978aca58c2b2c715a2

Tags:

Encryption Static Injection Exploit Obfusc

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

89%

Tags:

crypto epmicrosoft_visual_cc fingerprint installer lolbin lolbin microsoft_visual_cc overlay packed packed regsvr32 setupapi sfx shdocvw shell32

Link:

https://www.filescan.io/uploads/66f2bf949a3c6aa3e1293da7/reports/bbfc3d66-bd64-4856-acf1-045599620d6c/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/504f5f18e828012d45b3e559f4414eabbb9cb31f9e4a3e05863077bb90629be4

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/fbba070d-e425-4a76-a2b8-e7edf08c9a84

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1516781

Signature

AI detected suspicious sample

Antivirus detection for dropped file

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/504f5f18e828012d45b3e559f4414eabbb9cb31f9e4a3e05863077bb90629be4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/504f5f18e828012d45b3e559f4414eabbb9cb31f9e4a3e05863077bb90629be4/

Threat name:

Win32.Trojan.Zenpak

Status:

Malicious

First seen:

2024-09-24 13:33:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kbhv6ghifaas2rnt4vm7iqkovo5zzmy7tzfd4bmggb33xedctpsa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/240924-qtjaaszfqe/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks computer location settings

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/432e7e10-29ec-4e45-bd0f-ae5c8e80cf34

Unpacked files

SH256 hash:

504f5f18e828012d45b3e559f4414eabbb9cb31f9e4a3e05863077bb90629be4

MD5 hash:

766e5fe445153ec0e000de5070643c04

SHA1 hash:

d60a075e4245efe9b3795bea24f1a47b4776b037

Link:

https://www.unpac.me/results/f83d0448-e8df-475b-b193-e4d54aea2b24/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/504f5f18e828012d45b3e559f4414eabbb9cb31f9e4a3e05863077bb90629be4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_Malicious_VBScript_Base64 Create hunting rule
Author:	daniyyell
Description:	Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SelfExtractingRAR Create hunting rule
Author:	Xavier Mertens
Description:	Detects an SFX archive with automatic script execution

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 504f5f18e828012d45b3e559f4414eabbb9cb31f9e4a3e05863077bb90629be4

(this sample)

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
GDI_PLUS_API	Interfaces with Graphics	gdiplus.dll::GdiplusStartup gdiplus.dll::GdiplusShutdown gdiplus.dll::GdipAlloc
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryExA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::AllocConsole KERNEL32.dll::AttachConsole KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileMappingW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::MoveFileExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample