MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53e129e6b4bf741766737bbe3c9e12070388943c2649b9a829af75eefae79247. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53e129e6b4bf741766737bbe3c9e12070388943c2649b9a829af75eefae79247
SHA3-384 hash: e494b6b27be5349bc635ca42b327bf4119dac2264a5b33853b72050052ba1e5e6f67bf0127aee49f89b5eab3c5f3797b
SHA1 hash: 2a97af4e0de5c4ec202110bd70ed12671286ee2d
MD5 hash: b4796224dc192a7747017d2b5aa0673a
humanhash: beryllium-island-high-stream
File name:CFDI sat.mx.cmd
Download: download sample
File size:1'688'456 bytes
First seen:2022-10-25 11:11:24 UTC
Last seen:Never
File type:cmd cmd
MIME type:text/plain
ssdeep 24576:potxQMlJva9Ya7MLkx42rCpNofi6sznViZqzuW9Tg6yTtTK7ghb59Fz9BdnThKrj:qQCiTW6CwCnLu++gUr75hG
TLSH T16975CF3685B6BDDF732C2818840C2D530C18275317B64A5CEE4B467D2DD9223EBADABD
Reporter StopMalvertisin
Tags:Bola cmd Mispadu Ursa

Intelligence

File Origin
# of uploads :
1
# of downloads :
170
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PUA.Base64EXE-2.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1097528
Signature
Contains functionality to create processes via WMI
Creates processes via WMI
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 730179 Sample: CFDI sat.mx.cmd Startdate: 25/10/2022 Architecture: WINDOWS Score: 48 25 Contains functionality to create processes via WMI 2->25 7 cmd.exe 1 2->7         started        process3 process4 9 cmd.exe 30 7->9         started        11 conhost.exe 7->11         started        process5 13 WMIC.exe 1 9->13         started        16 certutil.exe 2 9->16         started        19 powershell.exe 15 9->19         started        21 4 other processes 9->21 file6 27 Creates processes via WMI 13->27 23 C:\Users\user\AppData\...\CFDI sat.mx.a3x, data 16->23 dropped signatures7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53e129e6b4bf741766737bbe3c9e12070388943c2649b9a829af75eefae79247/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kpqstzvux52bozttpo7dzhqsa4byrfb4eze3tkbjv52656xhsjdq._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  8/10
Tags:
collection spyware stealer
Link:
https://tria.ge/reports/221025-nh98jacecj/
Behaviour
Delays execution with timeout.exe
NTFS ADS
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Accesses Microsoft Outlook profiles
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/53e129e6b4bf741766737bbe3c9e12070388943c2649b9a829af75eefae79247

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/StopMalvertisin/status/1584769820209598465

Comments