MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 579b0544fb3ab18f7384df17157a80fcefe4e7d0d75550175ee5ebc5045cac39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 579b0544fb3ab18f7384df17157a80fcefe4e7d0d75550175ee5ebc5045cac39
SHA3-384 hash: 0bf62a8feee4613d5f38df7e61833b4558e36b6b7d8fc999e978dc3240d6e0925459161f5a3668a308ffe44c12cbb6fa
SHA1 hash: 79673c820018267a0720e71122cbccd745fb5497
MD5 hash: ade8657dc39e6078c7b0bfb7ce9cf138
humanhash: king-connecticut-wolfram-hamper
File name:SpotifySetup.exe
Download: download sample
File size:22'518'272 bytes
First seen:2023-10-03 14:03:49 UTC
Last seen:2023-10-03 14:23:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 49152:1sFo1D95BCNgIjZ7kt3VYzASHGtXy5VhRjFZR5zWQmAaIo2JZ3u0myRd7hCHPPDy:
Threatray 20 similar samples on MalwareBazaar
TLSH T18137372439FA501AB173EFAA8BE478EADA6FB7733B07645D105103864723981DEC153E
TrID 75.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.9% (.EXE) Win64 Executable (generic) (10523/12/4)
4.6% (.EXE) Win32 Executable (generic) (4505/5/1)
2.1% (.ICL) Windows Icons Library (generic) (2059/9)
2.1% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 71ccd4d0b0e4f030
Reporter stealerkiller
Tags:exe GoRAT RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
278
Origin country :
GB GB
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Searching for the window
Gathering data
Verdict:
Malicious
Labled as:
MSIL.Binder.Generic
Link:
https://www.hybrid-analysis.com/sample/579b0544fb3ab18f7384df17157a80fcefe4e7d0d75550175ee5ebc5045cac39
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
0 / 100
Link:
https://www.joesandbox.com/analysis/1318767
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
ByteCode-MSIL.Trojan.ReverseRat
Create hunting rule
Status:
Malicious
First seen:
2023-10-03 14:04:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
13 of 23 (56.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k6nqkrh3hkyy644e34lrk6ua7tx6jz6q25kvaf264xv4kbc4vq4q._file
Verdict:
malicious
Similar samples:
00515fe91a6b40d5c5ae851cb18d31c675ff38901edd352b3e6379087d5f2b26
32d54ecb913de9d4a1e9093092ad20501db0aca6e919b45fc6e73df6579a1ca2
3e49fe819025e4a6e061584f1a596f535d8c7dae935a079121ef19e0c11b3e60
3f2d5af3b57931be8c05661de3659f4cc9d8bd2d6efbcf38fee848c2f5d8dc43
4662be09fce319b69ed4365e2e4fb3654ae9f597bb060cf2a0cc8b567f445848
51d4a0ca42b1a0d5e63310e8872a7ecd9ed3046e9c72ef9d15d01b02b782c1ef
62904bd3def9671a1352f9cbc0d36e1981663bbd954c2f42e1e88460517d8784
69779c8531872ce18a47e818dea9e838f240cd9c38781880ef322a447cfd7d83
a1220eb6311115d3a4a6cbf77665fb444a54f9d715ee0e5c9651459222118c95
+ 10 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/231003-rc9lladb79/
Behaviour
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/579b0544fb3ab18f7384df17157a80fcefe4e7d0d75550175ee5ebc5045cac39

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments