MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5185c2ed67f7d2b19d3fe2ea6e1d6c89e597f633a5df206bd536620411e7db77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5185c2ed67f7d2b19d3fe2ea6e1d6c89e597f633a5df206bd536620411e7db77
SHA3-384 hash: 06adc3ec8f52107db890a792da18e8e4d87468992a0576924f4e4efb77a41752567ca0c2a7e4dea209fe1b3be185bcff
SHA1 hash: c0409a8e83d10f780bd1a4064742c359e9ebf0b3
MD5 hash: 05e9e1147953915cedf3976ad22f947e
humanhash: arizona-eighteen-massachusetts-three
File name:05e9e1147953915cedf3976ad22f947e.exe
Download: download sample
File size:324'608 bytes
First seen:2021-08-11 15:58:38 UTC
Last seen:2021-08-11 17:06:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d01336643bf96b29567aa2447e71141a (4 x RaccoonStealer, 3 x Smoke Loader, 1 x AZORult)
ssdeep 6144:zEaAJZ0BcUJRsTg6cS8PvKViwqm7knGyHM:wHQcU7gcS8qLI
Threatray 10 similar samples on MalwareBazaar
TLSH T18C64F1217EB8CC72D0960A314826C7E426BFBD61BE21524737683B6FEE703D1536635A
dhash icon 4839b2b0e8c38890 (105 x RaccoonStealer, 38 x Smoke Loader, 33 x RedLineStealer)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
05e9e1147953915cedf3976ad22f947e.exe
Verdict:
Malicious activity
Analysis date:
2021-08-11 16:00:20 UTC
Tags:
installer loader
Link:
https://app.any.run/tasks/e46c87b9-98de-4b2e-a337-4202f6da7bfb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178328/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.12528.29128.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Creating a process from a recently created file
Creating a process with a hidden window
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/04a3e7ec-acb0-4ee8-a467-78bf74c213ac
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/831112
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: System File Execution Location Anomaly
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5185c2ed67f7d2b19d3fe2ea6e1d6c89e597f633a5df206bd536620411e7db77/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2021-08-11 14:58:47 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
30715cfa9a065a5487098b26e563339ce8c1d12e468f9e418106cae9713eb7d6
7cf7cdb9043622708726ba0a16c4c4ffdcae7a603708a5a5dbca6c0973ccc1f4
81c01c383358ce9260d1dacaaf4acb281c3a467e391283b40101e4b8756765ae
8f2789b6a628a92f9f6313305b255c405f867c49161bb864263dcfef5a6f712d
96ab0a5a858b541c6e6fc44588405d29f8ba18bf8e8ff4af25b235135bbfd01a
b2ef736fad89cf9a80e5c37e4c8e0bcfec77ab815f4176f939569b0b525b8de5
dcd159c8484feb2b4b1db173cdbc3eb3b49c0b6c2b6bec43ec736243cb60b07d
de83c34f12bd4585c2428b672648046e3cd4e7489adb6bdcd592b2751a901cc1
e33c5b9d362c0f6a91945fdcb337f4e90d2cdf9397fac4ee0b5af9d7a96e4956
eb79c07d2967248ea62bfcf9698c175b3208ee2a8b69beef9a9ed0994315c91a
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan
Link:
https://tria.ge/reports/210811-9kehm6fqe6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Adds Run key to start application
Drops startup file
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Defender Real-time Protection settings
Malware Config
Dropper Extraction:
http://91.241.19.52/Api/GetFile2
Unpacked files
SH256 hash:
f06870bfd0324a7bff47bb59795cb93c290c895251cb26101e3b7f2aecb87a8c
MD5 hash:
f7964c5c2dddb97c9cbcdc70b11a956b
SHA1 hash:
e71a9313d26172b8cd6f2bce800381dd25e4857a
Link:
https://www.unpac.me/results/0a6fb0ed-8d2a-437e-95fc-7bde5d06d170/
SH256 hash:
5185c2ed67f7d2b19d3fe2ea6e1d6c89e597f633a5df206bd536620411e7db77
MD5 hash:
05e9e1147953915cedf3976ad22f947e
SHA1 hash:
c0409a8e83d10f780bd1a4064742c359e9ebf0b3
Link:
https://www.unpac.me/results/0a6fb0ed-8d2a-437e-95fc-7bde5d06d170/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5185c2ed67f7d2b19d3fe2ea6e1d6c89e597f633a5df206bd536620411e7db77

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 5185c2ed67f7d2b19d3fe2ea6e1d6c89e597f633a5df206bd536620411e7db77

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1523998/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/178328/

Comments