MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58399bfc49dfa256e09fab1b2c561b1e48c04f1ddb43e55e95c80acf06583dab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58399bfc49dfa256e09fab1b2c561b1e48c04f1ddb43e55e95c80acf06583dab
SHA3-384 hash: 75514801cbaf70964127c11957ff36cfee235ebd30e456480e821fd59b4a0ff11f32d733b19720423c4407380a2941ed
SHA1 hash: 1aedb6941c6b40332c6e596c35a78da77666d914
MD5 hash: 7e0b0dd36d786a018dc9713dc16c7e7e
humanhash: indigo-pizza-wolfram-friend
File name:z83Danfe-Pedido18042024.msi
Download: download sample
File size:19'917'312 bytes
First seen:2024-04-19 18:59:18 UTC
Last seen:2024-04-19 19:26:00 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:ArYM+ICT2y3E0iQRA8ckyGebpJJZ7tFT5:AsXI82x0iQR8kyNbpJJltX
Threatray 3 similar samples on MalwareBazaar
TLSH T12C177D13B284913AC46B0A3E9837DB74993BBE516E224C1737F83E4D6E766412D3B607
TrID 70.2% (.MSI) Microsoft Windows Installer (454500/1/170)
9.4% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.1% (.MSWMM) Windows Movie Maker project (46500/1/9)
6.8% (.MSP) Windows Installer Patch (44509/10/5)
5.0% (.XLS) Microsoft Excel sheet (32500/1/3)
Reporter FXOLabs
Tags:msi

Intelligence

File Origin
# of uploads :
2
# of downloads :
86
Origin country :
BR BR
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto fingerprint keylogger rat
Link:
https://www.filescan.io/uploads/6622bf3651edb67852f6f40a/reports/5f4b3df3-9a76-4e98-9fe5-5e2f1d779549/overview
Verdict:
Suspicious
Link:
https://www.hybrid-analysis.com/sample/58399bfc49dfa256e09fab1b2c561b1e48c04f1ddb43e55e95c80acf06583dab
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/58399bfc49dfa256e09fab1b2c561b1e48c04f1ddb43e55e95c80acf06583dab
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1428918
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1428918 Sample: z83Danfe-Pedido18042024.msi Startdate: 19/04/2024 Architecture: WINDOWS Score: 48 21 Multi AV Scanner detection for submitted file 2->21 6 msiexec.exe 9 39 2->6         started        9 msiexec.exe 2 2->9         started        process3 file4 13 C:\Windows\Installer\MSI9E5D.tmp, PE32 6->13 dropped 15 C:\Windows\Installer\MSI9D90.tmp, PE32 6->15 dropped 17 C:\Windows\Installer\MSI9D60.tmp, PE32 6->17 dropped 19 2 other files (none is malicious) 6->19 dropped 11 msiexec.exe 6->11         started        process5
Score:
8%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/58399bfc49dfa256e09fab1b2c561b1e48c04f1ddb43e55e95c80acf06583dab
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58399bfc49dfa256e09fab1b2c561b1e48c04f1ddb43e55e95c80acf06583dab/
Threat name:
Win32.Trojan.SpywareX
Create hunting rule
Status:
Malicious
First seen:
2024-04-19 16:27:54 UTC
File Type:
Binary (Archive)
Extracted files:
822
AV detection:
13 of 36 (36.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=la4zx7cj36rfnye7vmnsyvq3dzematy53nb6kxuvzafm6bsyhwvq._file
Verdict:
unknown
Similar samples:
58399bfc49dfa256e09fab1b2c561b1e48c04f1ddb43e55e95c80acf06583dab
6a94447715f2799d8b5fe10299fd93fe3d37c1bc89a6aaaa3781c689f0bc153b
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/240419-xnmtvscg23/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Loads dropped DLL
Enumerates connected drives
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_LATAM_MSI_Banker
Create hunting rule
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Microsoft Software Installer (MSI) msi 58399bfc49dfa256e09fab1b2c561b1e48c04f1ddb43e55e95c80acf06583dab

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments