MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5521400dffe660536524b06e28edc0805136092457722f3e1246a8749a0a7471. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5521400dffe660536524b06e28edc0805136092457722f3e1246a8749a0a7471
SHA3-384 hash: fcf1b60c150b74d449df993955e4aad7a87d43df6c2aa302d5f27b547066cf3cc1cd69137f70bda171f03f5331eb4557
SHA1 hash: 2c19fdc307c1464da5709936bf397b362944a281
MD5 hash: ab94b3d4c4960558efd04d38fd42d77a
humanhash: beer-bravo-low-butter
File name:ab94b3d4c4960558efd04d38fd42d77a.exe
Download: download sample
File size:412'160 bytes
First seen:2021-08-12 06:41:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5ba12e6852ba82499f5822056a147515 (2 x RaccoonStealer, 2 x KPOTStealer, 2 x Smoke Loader)
ssdeep 6144:Ewc7tETNaagoFClZa34KOOh5X5jKpZjLg40QBSCPaS7knGyHM:EwEETN/ZClZa/h5X5jKpq40Q0CLI
Threatray 4'305 similar samples on MalwareBazaar
TLSH T1B094F121BD7CE872D5C6407144B6C7B4D62FB9607A6211AB3768375FEE30392233A74A
dhash icon 4839b2b4e8c38890 (137 x RaccoonStealer, 37 x Smoke Loader, 30 x RedLineStealer)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ab94b3d4c4960558efd04d38fd42d77a.exe
Verdict:
Malicious activity
Analysis date:
2021-08-12 06:52:36 UTC
Tags:
installer
Link:
https://app.any.run/tasks/64c5023c-31be-4a35-a81a-cee52ed00dba

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178500/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.3912.2445.3694.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/af1e6eb4-c468-4758-9ba4-9fff1efa6ade
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/831480
Signature
Contains VNC / remote desktop functionality (version string found)
Creates a thread in another existing process (thread injection)
Creates autostart registry keys with suspicious names
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 463913 Sample: k7CnY78XRj.exe Startdate: 12/08/2021 Architecture: WINDOWS Score: 100 54 Multi AV Scanner detection for submitted file 2->54 56 Machine Learning detection for sample 2->56 58 Contains VNC / remote desktop functionality (version string found) 2->58 60 4 other signatures 2->60 7 k7CnY78XRj.exe 2 4 2->7         started        11 33A2E4F0.exe 2->11         started        13 33A2E4F0.exe 2->13         started        process3 file4 42 C:\ProgramData\...\33A2E4F0.exe, PE32 7->42 dropped 62 Detected unpacking (changes PE section rights) 7->62 64 Detected unpacking (overwrites its own PE header) 7->64 66 Creates autostart registry keys with suspicious names 7->66 15 33A2E4F0.exe 7->15         started        signatures5 process6 dnsIp7 44 ebanat6977769.com 8.209.79.46, 49771, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 15->44 46 Multi AV Scanner detection for dropped file 15->46 48 Detected unpacking (changes PE section rights) 15->48 50 Detected unpacking (overwrites its own PE header) 15->50 52 4 other signatures 15->52 19 WerFault.exe 9 15->19         started        22 WerFault.exe 9 15->22         started        24 WerFault.exe 9 15->24         started        26 4 other processes 15->26 signatures8 process9 file10 28 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 19->28 dropped 30 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 22->30 dropped 32 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 24->32 dropped 34 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 26->34 dropped 36 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 26->36 dropped 38 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 26->38 dropped 40 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 26->40 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5521400dffe660536524b06e28edc0805136092457722f3e1246a8749a0a7471/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-08-11 22:32:02 UTC
AV detection:
27 of 46 (58.70%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
2e3b767101904dd4352ece4ac162a9253edc02609db93ef70801e3a6fe1268f4
32e30f494b7bb01ab18836029193c2a79fb63795f978eeed31103f368c6d8fba
596e82d24c64a373095159ee769df582d6f34fde24eb537aca442d8f01c491db
74e82ea63f25fdb065ab8d4df1d69f9a22d1c1a76edf609f2f22d5080411fe4c
87fce4a9bf5b5a94b0a722c3061fd931a2fadd301880801b64a1e78d79bb67c5
9f3805a821c12122b67395c50e390d35c70e83d5b82a6e5741e56c0087960a60
a7d4ad5e6eedf5be0ad6f9ffc704827b7c1e9aeb12d440c847031af8d4d1f7b1
a8e2a996c913eb390bd0074d461a97156ad7395ae5ca856c2a6e6c14be534e2d
c9052a72f8d94fabf633aa750a1f7dbf0f211ef4be463443d2d064ffa8bb79d7
cceb5da1ebba042d949f4afef5f5e4638826493201564245be0448920dac639c
+ 4'295 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/210812-32xcea9kme/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
8fe1877b2cb312eaa3b1fd4b10bcd9c4050a86f55b602704db3a6a453ff0e7a8
MD5 hash:
2ec55de670faf40bbce8624884512519
SHA1 hash:
de87552e3af4bd3f9cd7baa93b652fc21c60b952
Link:
https://www.unpac.me/results/ea7ea44c-7ba3-4b19-a2e1-0122f8ef4765/
SH256 hash:
5521400dffe660536524b06e28edc0805136092457722f3e1246a8749a0a7471
MD5 hash:
ab94b3d4c4960558efd04d38fd42d77a
SHA1 hash:
2c19fdc307c1464da5709936bf397b362944a281
Link:
https://www.unpac.me/results/ea7ea44c-7ba3-4b19-a2e1-0122f8ef4765/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/5521400dffe6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5521400dffe660536524b06e28edc0805136092457722f3e1246a8749a0a7471

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 5521400dffe660536524b06e28edc0805136092457722f3e1246a8749a0a7471

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1525649/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/178500/

Comments