MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5788de5efeb9850b6fdea52dbe26a4aa9fa28dfbfd56280b4533226157d1c9a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5788de5efeb9850b6fdea52dbe26a4aa9fa28dfbfd56280b4533226157d1c9a5
SHA3-384 hash: 0a3a7847a7525e16d92e57fa58a4891ea8a65ab9de4c73e0e18e335b4512d58d86cc79ef43762c65202b0a95b3bc6905
SHA1 hash: 960a787c3b13336f47ec83941075cc4fd485765f
MD5 hash: a5e1b2c81a61f141540e2e4d14c1e4de
humanhash: music-pip-seventeen-three
File name:Four.exe
Download: download sample
File size:114'176 bytes
First seen:2021-04-08 12:46:32 UTC
Last seen:2021-04-08 14:03:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 3072:9l8/iMBQYp4SbwzDC2aJDeEsXcXPBQA6S4QF:PAL7wzsDeEssXPBQA6O
Threatray 111 similar samples on MalwareBazaar
TLSH 67B32A92E18D06ACCC382C34305A0B9D0FFBDDFFC56972E559D672221AB27A08636D57
Reporter JAMESWT_WT
Tags:greataccesstoserver.com

Intelligence

File Origin
# of uploads :
2
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/133203/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Bsymem.gen.8281.25439.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Connecting to a non-recommended domain
Sending a custom TCP request
Creating a file
Creating a window
Launching a process
Sending an HTTP POST request
Connection attempt
Sending a UDP request
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Pontoeb
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/859a61aa-71ba-4522-bde6-7068cd66f48f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/670167
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Detected unpacking (overwrites its own PE header)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 384029 Sample: Four.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 92 71 yt3.ggpht.com 2->71 73 www.google.ch 2->73 75 43 other IPs or domains 2->75 115 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->115 117 Antivirus / Scanner detection for submitted sample 2->117 119 Multi AV Scanner detection for submitted file 2->119 121 3 other signatures 2->121 10 Four.exe 14 9 2->10         started        15 multitimer.exe 2->15         started        signatures3 process4 dnsIp5 99 greataccesstoserver.com 159.89.4.33, 49697, 80 DIGITALOCEAN-ASNUS United States 10->99 101 digitalassets.ams3.digitaloceanspaces.com 5.101.110.225, 443, 49698 DIGITALOCEAN-ASNUS Netherlands 10->101 65 C:\Users\user\AppData\...\multitimer.exe, PE32 10->65 dropped 67 C:\Users\user\AppData\Local\...\setups.exe, PE32 10->67 dropped 69 C:\Users\user\AppData\Local\...\Four.exe.log, ASCII 10->69 dropped 123 Detected unpacking (overwrites its own PE header) 10->123 17 setups.exe 2 10->17         started        21 multitimer.exe 14 17 10->21         started        file6 signatures7 process8 dnsIp9 55 C:\Users\user\AppData\Local\...\setups.tmp, PE32 17->55 dropped 113 Multi AV Scanner detection for dropped file 17->113 24 setups.tmp 6 26 17->24         started        77 new.multitimer.fun 104.248.119.44, 443, 49700 DIGITALOCEAN-ASNUS United States 21->77 79 catser.inappapiurl.com 138.197.53.157, 443, 49699, 49701 DIGITALOCEAN-ASNUS United States 21->79 81 3 other IPs or domains 21->81 27 multitimer.exe 21->27         started        file10 signatures11 process12 file13 57 C:\Users\user\AppData\Local\...\psvince.dll, PE32 24->57 dropped 59 C:\Users\user\AppData\...\itdownload.dll, PE32 24->59 dropped 61 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 24->61 dropped 63 2 other files (none is malicious) 24->63 dropped 29 iexplore.exe 1 119 24->29         started        32 iexplore.exe 24->32         started        34 iexplore.exe 24->34         started        36 multitimer.exe 27->36         started        process14 dnsIp15 103 www.gearbest.com 29->103 105 go.oclasrv.com 29->105 107 catser.inappapiurl.com 29->107 38 iexplore.exe 29->38         started        41 iexplore.exe 29->41         started        43 iexplore.exe 29->43         started        51 10 other processes 29->51 109 www.gearbest.com 32->109 111 catser.inappapiurl.com 32->111 45 iexplore.exe 32->45         started        47 iexplore.exe 32->47         started        49 iexplore.exe 32->49         started        53 3 other processes 32->53 process16 dnsIp17 83 2 other IPs or domains 38->83 85 31 other IPs or domains 41->85 87 26 other IPs or domains 43->87 89 18 other IPs or domains 45->89 91 33 other IPs or domains 47->91 93 18 other IPs or domains 49->93 95 40 other IPs or domains 51->95 97 14 other IPs or domains 53->97
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5788de5efeb9850b6fdea52dbe26a4aa9fa28dfbfd56280b4533226157d1c9a5/
Threat name:
Win32.Adware.CSDIMonetize
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 12:42:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
16 of 29 (55.17%)
Threat level:
  1/5
Verdict:
malicious
Similar samples:
0cae975d5c602437ef781f39605c9a79fe0c0bca956bd4fecb21e17ace1c58ca
0ed95818ba222ec8d2ae4fdaaed1b143d9faada09c27a6c8aaecb8aa5ceb270f
5440a5863002acacb3ddb6b1deb84945aa004ace8bd64938b681e3fe059a8a23
97db3a9f804cdc5a97cfc32fede3ce5f31ed7756be6d4749123e87967e810dc2
a546a1f257585e2f4c093db2b7eeb6413a314ffb1296d97fd31d0363e827cc65
a67d2e2f39e4e2525386112c18294cc16af6dc062ff9d1c27124ff49291402fd
b1adf30c5cb4c1a7c06e877308d0f0e32f6ea1b21105de5db7583a889d089373
b8a5cf81ab9584f1ca6e937c2b6e2f399c4dcd81fc300b0746c4fbfd98b80ff7
bf81bf5e34c04aed363d975f7d3c8af217349011ee1083d3f50b71de885b4847
e99107f51a615207824a28411b0355fba67cbda8dbd24d450a84cbe40aa8faf5
+ 101 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:glupteba family:metasploit family:vidar backdoor discovery dropper evasion loader persistence stealer trojan upx vmprotect
Link:
https://tria.ge/reports/210408-3sye1p63nj/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Modifies system certificate store
Runs ping.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Adds Run key to start application
Checks for any installed AV software in registry
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Maps connected drives based on registry
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
UPX packed file
VMProtect packed file
ACProtect 1.3x - 1.4x DLL software
Checks for common network interception software
Glupteba
Glupteba Payload
MetaSploit
Vidar
Malware Config
Dropper Extraction:
http://labsclub.com/welcome
Unpacked files
SH256 hash:
5788de5efeb9850b6fdea52dbe26a4aa9fa28dfbfd56280b4533226157d1c9a5
MD5 hash:
a5e1b2c81a61f141540e2e4d14c1e4de
SHA1 hash:
960a787c3b13336f47ec83941075cc4fd485765f
Link:
https://www.unpac.me/results/8ab3dec4-aecb-41a0-b0e9-c0e5cfc0af09/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5788de5efeb9850b6fdea52dbe26a4aa9fa28dfbfd56280b4533226157d1c9a5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 5788de5efeb9850b6fdea52dbe26a4aa9fa28dfbfd56280b4533226157d1c9a5

(this sample)

  
X
https://twitter.com/jstrosch/status/1379994923286466565?s=20
  
URLhaus
https://urlhaus.abuse.ch/url/1104386/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/133203/

Comments