MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55232ec88f1f24f83153768b6a50e97157c2690184e2f5070bc3a9590a5b0d36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55232ec88f1f24f83153768b6a50e97157c2690184e2f5070bc3a9590a5b0d36
SHA3-384 hash: 986aebfadfda0ff91041af10b1ce1b909c1ea816cd785396e57e83dcb817817da3ee181f7483880be1afe040649f406b
SHA1 hash: 16d9ac046940d8a0a0130a5051c0e82bf36a5398
MD5 hash: 7a1d43aeba2a1d460df31ebd8463ac07
humanhash: tennis-eleven-jersey-gee
File name:SecuriteInfo.com.FileRepMalware.25619.15433
Download: download sample
File size:2'901'238 bytes
First seen:2023-04-22 04:27:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 884310b1928934402ea6fec1dbd3cf5e (3'725 x GCleaner, 3'463 x Socks5Systemz, 262 x RaccoonStealer)
ssdeep 49152:/2zT/j0AG7BmgYBf/ZkYDXAOcLxAcEUc965WZZSmTE7LXMUHsH0V0XM:enj0JVm/peYDXAOcVARUygeZSmTEXlHF
TLSH T166D53308E67288A9E2D64FFA4FB3921D497731B14E72419031A982EECF677C3519732D
TrID 75.1% (.EXE) Inno Setup installer (109740/4/30)
9.7% (.EXE) Win32 Executable Delphi generic (14182/79/4)
4.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.0% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
File icon (PE):PE icon
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
244
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.FileRepMalware.25619.15433
Verdict:
Malicious activity
Analysis date:
2023-04-22 04:29:19 UTC
Tags:
installer
Link:
https://app.any.run/tasks/883bc960-6a19-43a3-803d-19e1cfdc56f9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/384153/
Detection(s):
SecuriteInfo.com.FileRepMalware.25619.15433.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/80874/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware installer overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6443627a2eb85408cdf6cba3/reports/7370d090-36e1-4db9-9732-9172cf880012/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/55232ec88f1f24f83153768b6a50e97157c2690184e2f5070bc3a9590a5b0d36
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d86d5d12-2a82-4928-82e9-110ebea3aa68
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
26 / 100
Link:
https://www.joesandbox.com/analysis/1219059
Signature
Multi AV Scanner detection for submitted file
Obfuscated command line found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 852005 Sample: SecuriteInfo.com.FileRepMal... Startdate: 22/04/2023 Architecture: WINDOWS Score: 26 36 Multi AV Scanner detection for submitted file 2->36 7 SecuriteInfo.com.FileRepMalware.25619.15433.exe 2 2->7         started        11 ESP.exe 2->11         started        13 ESP.exe 2->13         started        process3 file4 26 SecuriteInfo.com.F...are.25619.15433.tmp, PE32 7->26 dropped 38 Obfuscated command line found 7->38 15 SecuriteInfo.com.FileRepMalware.25619.15433.tmp 33 31 7->15         started        signatures5 process6 file7 28 C:\Windows\SysWOW64\vbalflbr6.dll (copy), PE32 15->28 dropped 30 C:\Windows\SysWOW64\skinboxer43.dll (copy), PE32 15->30 dropped 32 C:\Windows\SysWOW64\is-H2GGU.tmp, PE32 15->32 dropped 34 30 other files (17 malicious) 15->34 dropped 18 regsvr32.exe 108 15->18         started        20 regsvr32.exe 181 15->20         started        22 regsvr32.exe 45 15->22         started        24 8 other processes 15->24 process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/55232ec88f1f24f83153768b6a50e97157c2690184e2f5070bc3a9590a5b0d36/
Threat name:
Win32.Spyware.PowerSpy
Create hunting rule
Status:
Malicious
First seen:
2013-01-03 11:35:00 UTC
File Type:
PE (Exe)
Extracted files:
267
AV detection:
5 of 37 (13.51%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kurs5sepd4spqmkto2fwuuhjofl4e2ibqtrpkbylyouvscs3bu3a._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230422-e3rr9ace75/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
c449b76a0618cd6d6726c24f0455a5f0bd1e6fc587fb68b2ae4da9c2fe8f626a
MD5 hash:
94916282e04e4150ca8e8cffd6acc678
SHA1 hash:
bd9fb979ec08419093de5758d28bedfb28114c97
Link:
https://www.unpac.me/results/5058e8a5-2b62-4ebf-9a85-1b9476a4c4c6/
SH256 hash:
a07819be1a0bb4eafd967d668d69fa1e8a117162b884ee6914bd511f06d6b491
MD5 hash:
d37171a70c8d6c517be2fe4bb1f8fa4a
SHA1 hash:
b31bb4af01bcc41bc173c14b8ee271ad9219d16e
Link:
https://www.unpac.me/results/5058e8a5-2b62-4ebf-9a85-1b9476a4c4c6/
SH256 hash:
ecbc6f4c259f86a13d3ab55af47d101840e2dc635cdbe8cfc85bc1ea418f5e5a
MD5 hash:
c074b129a5c82b31286f0e1a26e0594c
SHA1 hash:
aef712e8f9699279c4ff0a4870462ef2c083d512
Link:
https://www.unpac.me/results/5058e8a5-2b62-4ebf-9a85-1b9476a4c4c6/
SH256 hash:
dd353421f3cc79c850f419640bdc875e5d065cd583d19ecf132acdc366e9fb05
MD5 hash:
c2b8d6714620c90f8a7c5cc96c14727b
SHA1 hash:
9ac767ad5faa7ff3159dc268009b016df264f822
Link:
https://www.unpac.me/results/5058e8a5-2b62-4ebf-9a85-1b9476a4c4c6/
SH256 hash:
3a7b8edb7ad7cd0c1f120a52c87d741e2695194bd7d3a9210adca53cc5b6c52d
MD5 hash:
1d277428f6609458b83497d25a6492d0
SHA1 hash:
902869756dec8b533aa06e8b8bfd21275ab4db78
Link:
https://www.unpac.me/results/5058e8a5-2b62-4ebf-9a85-1b9476a4c4c6/
SH256 hash:
5cfa49fbaf8c759c57635310a6a1cbb2a603d1ecf29b8e6329f46dfd7fbc1f53
MD5 hash:
679076eb21dc80297f4a5f3c09fce61f
SHA1 hash:
5b6a54bcd158f3c639f4cc2a61b7bec32ea6422b
Link:
https://www.unpac.me/results/5058e8a5-2b62-4ebf-9a85-1b9476a4c4c6/
SH256 hash:
35b175e750b0efe45ecbbb692561f8d56368adf36fc7a61a2e9eb78ff8d649b9
MD5 hash:
d4931277df5393e84a48b27df40914e3
SHA1 hash:
59903e96e1edc257a4850d45ad8c63f17454ae9d
Link:
https://www.unpac.me/results/5058e8a5-2b62-4ebf-9a85-1b9476a4c4c6/
SH256 hash:
79986cfce57aa4c33bd307aec95bb376a0ed791ad56672647390603e9bb4abb1
MD5 hash:
3a27027407c8a868e97c5a6a871b01b3
SHA1 hash:
53a12a1b6896cf34f5e841f752db1363e7b1d77b
Link:
https://www.unpac.me/results/5058e8a5-2b62-4ebf-9a85-1b9476a4c4c6/
SH256 hash:
bc125a937ceb9adb948fcef659d36f07ced94e430f6aa9e5ebae52d4227d3c3c
MD5 hash:
d9ddaf20b90ef6ce04b4223e20d85261
SHA1 hash:
4089362e4b8c621c4079fe480ee93c4d42a0be67
Link:
https://www.unpac.me/results/5058e8a5-2b62-4ebf-9a85-1b9476a4c4c6/
SH256 hash:
3cc2c2a64b7c64b269a92ebaf18cccbfcab8e4cd1563b5fa1b1153b34ae16994
MD5 hash:
03936995417f746fda43ecd090ab3150
SHA1 hash:
10b882b9ff4b6aafb791fd88c3f5e351449746c3
Link:
https://www.unpac.me/results/5058e8a5-2b62-4ebf-9a85-1b9476a4c4c6/
SH256 hash:
f7e7ed6280b668b2912dc75fd38fd37555e5a16593ee7bcc58cf907948a8fc7c
MD5 hash:
1e1018d5b637d1b61cdfb81fee38673e
SHA1 hash:
0d9f230497670ea50c6983ab5122eb2be8423a3d
Link:
https://www.unpac.me/results/5058e8a5-2b62-4ebf-9a85-1b9476a4c4c6/
SH256 hash:
a4629d1d4ce37c0815c4ea7e7e2d64c3247af3fc64b00a2b0313c68897145305
MD5 hash:
c6a755c360e08f0cf58344629a25ea07
SHA1 hash:
38da17638397dd91ed57922a36bc560fcde989a8
Link:
https://www.unpac.me/results/5058e8a5-2b62-4ebf-9a85-1b9476a4c4c6/
SH256 hash:
55232ec88f1f24f83153768b6a50e97157c2690184e2f5070bc3a9590a5b0d36
MD5 hash:
7a1d43aeba2a1d460df31ebd8463ac07
SHA1 hash:
16d9ac046940d8a0a0130a5051c0e82bf36a5398
Link:
https://www.unpac.me/results/5058e8a5-2b62-4ebf-9a85-1b9476a4c4c6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.88
Link:
https://yomi.yoroi.company/submissions/55232ec88f1f24f83153768b6a50e97157c2690184e2f5070bc3a9590a5b0d36

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/384153/

Comments