MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 558607b112f50fbc472d9d72f0d5179b931a461aa473274badd4e064ee432f2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 558607b112f50fbc472d9d72f0d5179b931a461aa473274badd4e064ee432f2a
SHA3-384 hash: 8d0445c8c0b1680f1d5eb57a847f462279e566481423033b4814b21aa91254f734cf33aa55b43f85e4f069e323d8ebff
SHA1 hash: e5b4c7ada93818fa73d59dbb44aad262bf5a9e14
MD5 hash: 3ffa3a6e1a8375c2652f45ccaceef095
humanhash: delaware-connecticut-jupiter-golf
File name:3ffa3a6e1a8375c2652f45ccaceef095
Download: download sample
File size:9'629'705 bytes
First seen:2022-05-21 22:32:56 UTC
Last seen:2022-05-26 08:10:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1e92fd54d65284238a0e3b74b2715062 (21 x Empyrean, 4 x Gh0stRAT, 4 x Telemiris)
ssdeep 196608:AqkPpCsXDjDyf6L2WliXYrHW1AEuH7IpBs5TCNr:SPpCEDVL2ciIrHW6JH7Ipq5O
Threatray 96 similar samples on MalwareBazaar
TLSH T106A63318631919F5FD67213E8C11C429DD32B4321B61C1AF0BAC64A34FA76E5B83BEE5
TrID 66.5% (.EXE) InstallShield setup (43053/19/16)
16.2% (.EXE) Win64 Executable (generic) (10523/12/4)
7.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.1% (.EXE) OS/2 Executable (generic) (2029/13)
3.0% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon c6c2ccc4f4e0e0f8 (37 x PythonStealer, 21 x CrealStealer, 19 x Empyrean)
Reporter zbetcheckin
Tags:exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
397
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3ffa3a6e1a8375c2652f45ccaceef095
Verdict:
No threats detected
Analysis date:
2022-05-21 22:36:24 UTC
Tags:
installer
Link:
https://app.any.run/tasks/fc636474-664e-4f03-9fcb-31ba0b85ed94

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Emotet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/273337/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/19479/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
expand.exe greyware overlay packed
Link:
https://www.filescan.io/uploads/628968a1054dcf0ecad9e865/reports/8087c4ba-dfb3-47ab-938b-f46515014ce3/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bb50c5b4-3486-42d8-9f78-716b02b3669d
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/999178
Signature
DLL reload attack detected
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/558607b112f50fbc472d9d72f0d5179b931a461aa473274badd4e064ee432f2a/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-05-16 12:06:23 UTC
File Type:
PE+ (Exe)
Extracted files:
459
AV detection:
13 of 40 (32.50%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
04a31ae8a31bb4144d7392040442f4a38e8301cc550124cc47d012a0eba71bdd
0df6eca30071051714c4d1b5bd16e11feb7a76ab208c907771d0dd470d91ab07
329d77b0ab5af0e568b9d56e3c3f7afc4266bf2cea0bd816ed4e67d4c9a09692
33f1a042ec0acd54bb8d13aa14215a5039c8dc95188df1685d36f35a9ca5ee0a
4e7105da7face5917f66842ba73810d29826cb971140f9da2b0efb7a37de3c0e
5e0eb79c69c7e3e88abf119505ee648f0980b190da91620e77e2bde0d892223d
a07afb3f48c05bc311adc6a9473310e6b35e14f14920e543ee8ca032a0af637f
bbaf8ed986b67aa0b15e3b880bc2943554ab0da471291c9dd1b24a96d7b1a124
cdd0d34714297037b5be052585421821a6c30d48866394ea0bb8c1a7f29a9195
d6c39d7d9be421b66517d195180f7156c52c3fadba440d5d3d26ff6b1d45aa1a
+ 86 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/220521-2ghc1sdga8/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Unpacked files
SH256 hash:
558607b112f50fbc472d9d72f0d5179b931a461aa473274badd4e064ee432f2a
MD5 hash:
3ffa3a6e1a8375c2652f45ccaceef095
SHA1 hash:
e5b4c7ada93818fa73d59dbb44aad262bf5a9e14
Link:
https://www.unpac.me/results/70efe630-7d60-4ecb-a132-84d18993be08/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/558607b112f50fbc472d9d72f0d5179b931a461aa473274badd4e064ee432f2a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 558607b112f50fbc472d9d72f0d5179b931a461aa473274badd4e064ee432f2a

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/273337/
  
URLhaus
https://urlhaus.abuse.ch/url/2205860/

Comments


Avatar
zbet commented on 2022-05-21 22:33:05 UTC

url : hxxp://lightnogu5owjjllyo4tj2sfos6fchnmcidlgo6c7e6fz2hgryhfhoyd.onion.pet/shared/telegram.exe