MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58b30c75db050e57a9f5c795c823627eda37ec253d63db428c970dcab058d9b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments

SHA256 hash:	58b30c75db050e57a9f5c795c823627eda37ec253d63db428c970dcab058d9b5
SHA3-384 hash:	254636df4ad28e939d7ffd342071658fa4b40480294fba5ba83d8ccd6ea9c26e1119b1551da783c5739acbde7560a59b
SHA1 hash:	eeda90caab0dbee1c9290c697e67da3fd4650b95
MD5 hash:	4bd206c9746ee362c938805e60dc113c
humanhash:	beryllium-wolfram-twenty-hamper
File name:	SecuriteInfo.com.Win32.MalwareX-gen.4623.4565
Download:	download sample
File size:	622'592 bytes
First seen:	2024-04-06 22:39:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ec9ed0c048b54c873cc3b1c7b5de3758
ssdeep	12288:FF/QenBaXWZY6elsVQHm0NDA+QkeQN0dQLih0:LJnBROMQHRqkerQ
TLSH	T148D423277F541917FD33C2B9AB93C70E7B2193CA2F5B8D1A21971D4299298D3742B322
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	3cece4e6b09888c4
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

296

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

58b30c75db050e57a9f5c795c823627eda37ec253d63db428c970dcab058d9b5.exe

Verdict:

No threats detected

Analysis date:

2024-04-06 22:50:28 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/99489d87-b113-4016-9942-ff991f65084a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Launching a process

Moving a file to the Program Files subdirectory

Replacing files

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug masquerade packed packed vmprotect vobfus

Link:

https://www.filescan.io/uploads/6611cf44ec04992a87dda464/reports/969fa601-7b38-4a57-b884-0eeb3b0e60ec/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/58b30c75db050e57a9f5c795c823627eda37ec253d63db428c970dcab058d9b5

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/767113b2-2703-45e7-88ab-e0dddb5dbf90

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1421424

Signature

Hides threads from debuggers

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Uses Windows timers to delay execution

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/58b30c75db050e57a9f5c795c823627eda37ec253d63db428c970dcab058d9b5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/58b30c75db050e57a9f5c795c823627eda37ec253d63db428c970dcab058d9b5/

Threat name:

Win32.Trojan.Znyonm

Status:

Malicious

First seen:

2023-10-21 13:37:32 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 38 (52.63%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lczqy5o3auhfpkpvy6k4qi3cp3ndp3bfhvr5wqums4g4vmcy3g2q._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/240406-2lhvcadb3s/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of NtSetInformationThreadHideFromDebugger

Unpacked files

SH256 hash:

58b30c75db050e57a9f5c795c823627eda37ec253d63db428c970dcab058d9b5

MD5 hash:

4bd206c9746ee362c938805e60dc113c

SHA1 hash:

eeda90caab0dbee1c9290c697e67da3fd4650b95

Link:

https://www.unpac.me/results/ba64dd1d-7ebb-40e6-83ad-df9b0b6802c4/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.54

Link:

https://yomi.yoroi.company/submissions/58b30c75db050e57a9f5c795c823627eda37ec253d63db428c970dcab058d9b5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::LoadLibraryA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample