MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58591d220d48fbc565054766db000c1d14250a02c160bfe86370877441e5d2da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58591d220d48fbc565054766db000c1d14250a02c160bfe86370877441e5d2da
SHA3-384 hash: 2c0a057e3b6960bec1862b06a6fac2aff11a1eeaba981646ad4634a27bc04eb19644218af537a5f1225b49e47877d1a2
SHA1 hash: 39eba9b695fd1e30ec8e107162cddb6292ef8af6
MD5 hash: babb688826260bbc6244fdc7bc59d82c
humanhash: finch-minnesota-south-four
File name:babb688826260bbc6244fdc7bc59d82c.exe
Download: download sample
File size:6'915'072 bytes
First seen:2023-01-15 14:33:12 UTC
Last seen:2023-01-15 16:36:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c5dd8e924969cc0e490131c9fb75c55c
ssdeep 196608:axv9riYmlbvRtgYr/Ehj2GV5I1VO891xSkTxpbc:Ev9ribZtTbo2Gc1c0xJzc
Threatray 1 similar samples on MalwareBazaar
TLSH T19A66330A39DE84FAFDCF5271860BFF8F27B554D645408858FAC968CAE613E1E5036A43
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 0070b0dae0a0a4a4 (1 x RemcosRAT, 1 x SnakeKeylogger, 1 x Smoke Loader)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
168
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
babb688826260bbc6244fdc7bc59d82c.exe
Verdict:
Malicious activity
Analysis date:
2023-01-15 14:38:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6a0fbf5e-6ab1-4559-b78f-cafa79b8f42e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/353130/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.64974440.18229.8067.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Launching a process
Creating a process with a hidden window
Enabling the 'hidden' option for recently created files
Sending a custom TCP request
Enabling autorun by creating a file
Verdict:
No Threat
Threat level:
  2/10
Confidence:
80%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63c40edcde614a115a166351/reports/44d21fe8-849c-486f-87f3-dfffb6fd6d26/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/449e57fc-57d3-4cf7-b2c0-2ee59df11827
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1151948
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 784680 Sample: VRc54V6jbI.exe Startdate: 15/01/2023 Architecture: WINDOWS Score: 80 33 Antivirus / Scanner detection for submitted sample 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 Machine Learning detection for sample 2->37 39 PE file contains section with special chars 2->39 7 VRc54V6jbI.exe 4 2->7         started        11 WindowsPaint-Ver1.7.7.5.exe 2->11         started        process3 file4 29 C:\...\WindowsPaint-Ver1.7.7.5.exe, PE32 7->29 dropped 31 WindowsPaint-Ver1....exe:Zone.Identifier, ASCII 7->31 dropped 41 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->41 43 Uses schtasks.exe or at.exe to add and modify task schedules 7->43 13 icacls.exe 1 7->13         started        15 icacls.exe 1 7->15         started        17 schtasks.exe 1 7->17         started        19 icacls.exe 1 7->19         started        45 Antivirus detection for dropped file 11->45 signatures5 process6 process7 21 conhost.exe 13->21         started        23 conhost.exe 15->23         started        25 conhost.exe 17->25         started        27 conhost.exe 19->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58591d220d48fbc565054766db000c1d14250a02c160bfe86370877441e5d2da/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2023-01-14 04:24:11 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lbmr2iqnjd54kzifi5tnwaamdukckcqcyfql72ddocdxiqpf2lna._file
Verdict:
malicious
Similar samples:
38bc4b2c42165431e09e969e3a346d249c1c10639a29fba6748ed14358748b78
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery
Link:
https://tria.ge/reports/230115-rxft1sbg8z/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Modifies file permissions
Executes dropped EXE
Unpacked files
SH256 hash:
58591d220d48fbc565054766db000c1d14250a02c160bfe86370877441e5d2da
MD5 hash:
babb688826260bbc6244fdc7bc59d82c
SHA1 hash:
39eba9b695fd1e30ec8e107162cddb6292ef8af6
Link:
https://www.unpac.me/results/eea01d1b-f6c7-4cb2-aee1-7e9236506ef5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/58591d220d48fbc565054766db000c1d14250a02c160bfe86370877441e5d2da

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 58591d220d48fbc565054766db000c1d14250a02c160bfe86370877441e5d2da

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2469977/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/353130/

Comments