MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 518d13a8d88566e280e58cc91dd9fa1c97d82ed3b256a6504c1971114492efd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.Neoreklami


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 518d13a8d88566e280e58cc91dd9fa1c97d82ed3b256a6504c1971114492efd5
SHA3-384 hash: 53af451e1658e4b6fddf4f381544d9e1c9c31baa18eb6bf2e8b13bde74a6a6cd789636f22869b36a02e02a218e4e5bfb
SHA1 hash: 4a37ba1e710055029ad5f681fb425de7b10d8ee4
MD5 hash: 391d4a464150942614b3e6a25c1eb9dc
humanhash: sad-alanine-nuts-tango
File name:file
Download: download sample
Signature Adware.Neoreklami
Create hunting rule
File size:7'616'025 bytes
First seen:2024-09-27 16:03:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3786a4cf8bfee8b4821db03449141df4 (2'102 x Adware.Neoreklami, 2 x RedLineStealer, 2 x Adware.MultiPlug)
ssdeep 196608:91OLdmaWTcZqnXHXvlMTvtSIk9CnIbvQnxMXEk:3OYbT0s3flqQJDQ2XN
TLSH T14576337636D85CFAC10255B20CD873E1F176F398E9B14A376BE68D4F093D40AC2658AE
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10523/12/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
File icon (PE):PE icon
dhash icon 848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox)
Reporter jstrosch
Tags:Adware.Neoreklami exe


Avatar
jstrosch
Found at hxxp://103.130.147[.]211/files/setup.exe by #subcrawl

Intelligence

File Origin
# of uploads :
1
# of downloads :
402
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-09-27 15:57:07 UTC
Tags:
loader opendir stealer cryptbot lumma adware neoreklami xor-url generic
Link:
https://app.any.run/tasks/fb24463a-1c34-49e3-8b44-85c9d260bd1b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Program.Unwanted.2823.171.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66f6d7774b14762f6212521c
Tags:
Encryption Execution Generic Network Stealth Trojan Autorun Gumen
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Launching cmd.exe command interpreter
Searching for the window
Creating a file
Creating a window
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc installer lolbin microsoft_visual_cc overlay packed sfx shell32
Link:
https://www.filescan.io/uploads/66f6d775476a69e57446c309/reports/997fb843-9418-41d9-9080-82d3904e35b7/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/518d13a8d88566e280e58cc91dd9fa1c97d82ed3b256a6504c1971114492efd5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8684b347-f24a-4b75-9fd2-0f23955c286a
Result
Threat name:
Neoreklami
Create hunting rule
Detection:
malicious
Classification:
adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1520686
Signature
AI detected suspicious sample
Antivirus detection for dropped file
Creates files in the recycle bin to hide itself
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies Group Policy settings
Modifies Windows Defender protection settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Suspicious powershell command line found
Uses cmd line tools excessively to alter registry or file data
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Neoreklami
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1520686 Sample: file.exe Startdate: 27/09/2024 Architecture: WINDOWS Score: 100 132 Antivirus detection for dropped file 2->132 134 Multi AV Scanner detection for dropped file 2->134 136 Multi AV Scanner detection for submitted file 2->136 138 8 other signatures 2->138 13 file.exe 7 2->13         started        16 Install.exe 2->16         started        process3 file4 120 C:\Users\user\AppData\Local\...\Install.exe, PE32 13->120 dropped 19 Install.exe 4 13->19         started        122 C:\Windows\Temp\...\kJFoOoU.exe, PE32 16->122 dropped 124 C:\Windows\System32behaviorgraphroupPolicy\gpt.ini, ASCII 16->124 dropped 126 Creates files in the recycle bin to hide itself 16->126 128 Modifies Windows Defender protection settings 16->128 130 Modifies Group Policy settings 16->130 23 cmd.exe 16->23         started        25 powershell.exe 16->25         started        signatures5 process6 file7 118 C:\Users\user\AppData\Local\...\Install.exe, PE32 19->118 dropped 144 Multi AV Scanner detection for dropped file 19->144 146 Machine Learning detection for dropped file 19->146 27 Install.exe 1 19->27         started        148 Modifies Windows Defender protection settings 23->148 30 forfiles.exe 23->30         started        32 forfiles.exe 23->32         started        34 forfiles.exe 23->34         started        42 3 other processes 23->42 150 Uses cmd line tools excessively to alter registry or file data 25->150 36 cmd.exe 25->36         started        38 conhost.exe 25->38         started        40 reg.exe 25->40         started        44 8 other processes 25->44 signatures8 process9 signatures10 156 Antivirus detection for dropped file 27->156 158 Multi AV Scanner detection for dropped file 27->158 160 Machine Learning detection for dropped file 27->160 162 Uses schtasks.exe or at.exe to add and modify task schedules 27->162 46 cmd.exe 1 27->46         started        49 forfiles.exe 1 27->49         started        51 schtasks.exe 27->51         started        164 Modifies Windows Defender protection settings 30->164 53 cmd.exe 30->53         started        55 cmd.exe 32->55         started        57 cmd.exe 34->57         started        166 Uses cmd line tools excessively to alter registry or file data 36->166 59 reg.exe 36->59         started        61 cmd.exe 42->61         started        63 cmd.exe 42->63         started        process11 signatures12 168 Suspicious powershell command line found 46->168 170 Uses cmd line tools excessively to alter registry or file data 46->170 172 Modifies Windows Defender protection settings 46->172 65 forfiles.exe 1 46->65         started        79 5 other processes 46->79 82 2 other processes 49->82 67 conhost.exe 51->67         started        69 reg.exe 53->69         started        71 reg.exe 55->71         started        73 reg.exe 57->73         started        75 powershell.exe 61->75         started        77 reg.exe 63->77         started        process13 signatures14 84 cmd.exe 1 65->84         started        87 gpupdate.exe 75->87         started        174 Modifies Windows Defender protection settings 79->174 89 cmd.exe 1 79->89         started        91 cmd.exe 1 79->91         started        93 cmd.exe 1 79->93         started        95 cmd.exe 1 79->95         started        176 Suspicious powershell command line found 82->176 97 powershell.exe 7 82->97         started        process15 signatures16 152 Suspicious powershell command line found 84->152 99 powershell.exe 12 84->99         started        102 conhost.exe 87->102         started        154 Uses cmd line tools excessively to alter registry or file data 89->154 104 reg.exe 1 1 89->104         started        106 reg.exe 1 1 91->106         started        108 reg.exe 1 1 93->108         started        110 reg.exe 1 1 95->110         started        112 WMIC.exe 1 97->112         started        process17 signatures18 140 Uses cmd line tools excessively to alter registry or file data 99->140 142 Modifies Windows Defender protection settings 99->142 114 gpupdate.exe 1 99->114         started        process19 process20 116 conhost.exe 114->116         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/518d13a8d88566e280e58cc91dd9fa1c97d82ed3b256a6504c1971114492efd5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/518d13a8d88566e280e58cc91dd9fa1c97d82ed3b256a6504c1971114492efd5/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2024-09-27 01:47:24 UTC
File Type:
PE (Exe)
Extracted files:
13
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kggrhkgyqvtofahfrter3wp2dsl5qlwtwjlkmucmdfyrcres57kq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery evasion execution spyware stealer trojan
Link:
https://tria.ge/reports/240927-thx6vszgmn/
Behaviour
Enumerates system info in registry
Modifies data under HKEY_USERS
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Checks installed software on the system
Drops Chrome extension
Drops desktop.ini file(s)
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Indirect Command Execution
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Modifies Windows Defender Real-time Protection settings
Windows security bypass
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d4ce8502-1e9b-43c0-b3d1-37f9b4057ec8
Unpacked files
SH256 hash:
0deda810ab2a964955eed775038de766900ba25a9bc9a5255ceeb1c499307d3d
MD5 hash:
ed84198ef404b8e8cafc9f2edfd00e50
SHA1 hash:
463544d3df5a1c49b3722d79d770105decc2f127
Link:
https://www.unpac.me/results/c7d89108-fc23-4182-b95b-7cace4164047/
SH256 hash:
518d13a8d88566e280e58cc91dd9fa1c97d82ed3b256a6504c1971114492efd5
MD5 hash:
391d4a464150942614b3e6a25c1eb9dc
SHA1 hash:
4a37ba1e710055029ad5f681fb425de7b10d8ee4
Link:
https://www.unpac.me/results/c7d89108-fc23-4182-b95b-7cace4164047/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/518d13a8d88566e280e58cc91dd9fa1c97d82ed3b256a6504c1971114492efd5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Adware.Neoreklami

Executable exe 518d13a8d88566e280e58cc91dd9fa1c97d82ed3b256a6504c1971114492efd5

(this sample)

  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::DeleteFileW

Comments