MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5250352cea9441dd051802bd58ccc6b2faf05007ee599e6876b9cce3fdc5aa26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5250352cea9441dd051802bd58ccc6b2faf05007ee599e6876b9cce3fdc5aa26
SHA3-384 hash: 51cf6f36582f0af2e79e710b78ec60076abe838a6ccee40a1b1a48e3bd84d931914659401c9d557110970b512dd8664c
SHA1 hash: d6cb3a04958c07b0449818068b91bb446472f6a0
MD5 hash: b6c874b722c475086f1a43849e029794
humanhash: wolfram-fanta-burger-glucose
File name:Olxnzpvbvlurvcumfk.dll
Download: download sample
File size:612'352 bytes
First seen:2022-03-27 01:59:26 UTC
Last seen:2022-03-27 02:27:28 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 12288:Rp3Cga58sx1CqPAoBQ6BYpjJLvb/uvilL42sHDXzvTO:CF/aoil81D
Threatray 2'398 similar samples on MalwareBazaar
TLSH T1D4D49B097B59EE52C3AC07B3C1D7491487F98447F5AAF79A2AE424F82D033F5990938B
Reporter ForensicITGuy
Tags:AgentTesla dll

Intelligence

File Origin
# of uploads :
2
# of downloads :
245
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/258112/
Detection(s):
SecuriteInfo.com.Heur.Variadic.A.466.1.28123.2550.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/623fc52c9253b276b77f0288/reports/51b6894e-2d6d-4ddc-b63c-2496995dd3b0/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c42b5da8-3767-4bf7-b6f0-01004d42656d
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/965190
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Machine Learning detection for sample
Sigma detected: Suspicious Call by Ordinal
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Trojan.RealProtectPENGSD
Create hunting rule
Status:
Malicious
First seen:
2022-03-27 02:09:14 UTC
File Type:
PE (.Net Dll)
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
052ea3c932ea0e93a94b717c4c1481cfcb03d20bb9b34ad3d6eced801e3ceb51
0cf5c56abe0bfddd98d9bd5ad976e99caaa170e02ca43902773c4d4c7f47bc69
113f7d494327f9fe96dac9d9f4bccc411f3062100cec63b78fc646799d296e75
3266cc6c2a2fc1f64000b1ca849da565470cf2bf119fbe377e7ad5234756dba5
4bafcfded2a23cae4a88071893eedbaea9e47031cdfe8ef0c2b97fa55de6feb3
4d1bc3b0096832b12fac401d7c92e3e50d4a1a328435ef2463b2cb0138feb6a5
854bd9747a0ee5f5f619a64be5c94383caa20d465d51a01a784418a30ed6cdc4
ac5593f6eda0771d560c4dc764d2381144c7ea5e1c61d11af6e075a4795478d4
bcca18fef46e71ff82ff342dbd50f09b9ea768edc5e328fbf85241fcf615507d
d1c616976e917d54778f587a2550ee5568a72b661d5f04e68d194ce998864d84
+ 2'388 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220327-ce6kdscad4/
Unpacked files
SH256 hash:
5250352cea9441dd051802bd58ccc6b2faf05007ee599e6876b9cce3fdc5aa26
MD5 hash:
b6c874b722c475086f1a43849e029794
SHA1 hash:
d6cb3a04958c07b0449818068b91bb446472f6a0
Link:
https://www.unpac.me/results/d60e9ac8-5e41-4cca-aa26-8681d2b79362/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5250352cea9441dd051802bd58ccc6b2faf05007ee599e6876b9cce3fdc5aa26

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Executable exe fa4a2fe97735db2bd605f3073a3e1bd2698b5a35419889a7c47eda7988e65f73

DLL dll 5250352cea9441dd051802bd58ccc6b2faf05007ee599e6876b9cce3fdc5aa26

(this sample)

  
Dropped by
SHA256 fa4a2fe97735db2bd605f3073a3e1bd2698b5a35419889a7c47eda7988e65f73
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/258112/

Comments