MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57099b79a9824765f8be07471ec33c4cc0799abd877637a2a85affc50e163b1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Lazarus


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57099b79a9824765f8be07471ec33c4cc0799abd877637a2a85affc50e163b1b
SHA3-384 hash: 1e38708ec05623c16c453c715874597d3cc332967d0dfd358252daeca51fd9d24ddb09937686cf6d2fd0d073c28647cf
SHA1 hash: 8bc8aeab907c2294dda208d9b41b474afafa014f
MD5 hash: 37f1c4dfbfc423130c851bc98cbab5d7
humanhash: quebec-papa-wyoming-virginia
File name:New Salary Adjustments.zip
Download: download sample
Signature Lazarus
Create hunting rule
File size:560'131 bytes
First seen:2022-08-05 13:15:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:uodsteBu+NbvS/jyA2aWM8Hzep6zFdQZ2D9NeeCd:ur8vBqyP3egzFys9QB
TLSH T16BC4336811E674514581E7B1490283A6FE39CD3FD0FDD8230E8B4B3B5B8A1DA73C9257
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter JAMESWT_WT
Tags:apt DangerousPassword Lazarus zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
404
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_txt.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27118.LnkHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.26476.PshHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.ReturnOfTheMac.94b86d42681d.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.MachineHead.desktop-nl7f86k.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.EveryMeEveryYou.20220722.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/62ed1851bcf76fcb6ce81158/reports/48d05bd8-3dfb-40d7-aea0-4b1e029574c5/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/57099b79a9824765f8be07471ec33c4cc0799abd877637a2a85affc50e163b1b/
Threat name:
Shortcut.Trojan.WinLnk
Create hunting rule
Status:
Malicious
First seen:
2022-08-05 13:16:07 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k4ezw6njqjdwl6f6a5dr5qz4jtahtgv5q53dpivill74kdqwhmnq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/220805-qhs1csdbc3/
Behaviour
Checks processor information in registry
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Malware Config
Dropper Extraction:
https://www.googlesheet.info/NZrTnPVmtfjcSMz8n1hZZzvHQvUUEfFnIMAYliQuR+A=
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/57099b79a9824765f8be07471ec33c4cc0799abd877637a2a85affc50e163b1b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/ShadowChasing1/status/1555541684599279618?s=20&t=8m19LlR_DZ0FMJJpTKXDWg

Comments