MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d027c381ddadd04a2394bb9472793cf50bc9722db79419b7d9f2d7fd64a4fc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5d027c381ddadd04a2394bb9472793cf50bc9722db79419b7d9f2d7fd64a4fc5
SHA3-384 hash:	b0ad2e5f4d5d8b1f6d8fd05afbea354c15d6894fa3c63c65076dfabcf9fa5e81a2b6eb0320033f8f1b56012b0707cae8
SHA1 hash:	c0d07cf180ed045b4252a506fa8eb956455caca8
MD5 hash:	a05d14aafaec11098f00629a5fcfc8af
humanhash:	angel-golf-carolina-oranges
File name:	a05d14aafaec11098f00629a5fcfc8af.exe
Download:	download sample
Signature	Phonk Alert Create hunting rule
File size:	989'696 bytes
First seen:	2023-06-30 07:33:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	12288:TnTNTabSHtymnzl2ajb/ZRykVz0RD5TeNIw1Q:TnlaEtzbjb/Lyk10R
Threatray	2'981 similar samples on MalwareBazaar
TLSH	T125256EAD3A571DB3CD4F3DF9C3512A885B20C4DABF2094E62E5245C8B22D157ED8D0AB
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	abuse_ch
Tags:	exe Phonk

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

274

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN redline

Malware family:

redline

Alert

Create hunting rule

ID:

1

File name:

https://cdn.discordapp.com/attachments/1117241903277150320/1117243387679088670/SetupX.zip

Verdict:

Malicious activity

Analysis date:

2023-06-11 07:18:26 UTC

Tags:

rat redline

Link:

https://app.any.run/tasks/ca806680-b9c5-4d89-9e97-557c36c89ae6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/403976/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Variant.Barys.425519.2448.5998.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a file

Using the Windows Management Instrumentation requests

Adding an exclusion to Microsoft Defender

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

barys coinminer lolbin replace

Link:

https://www.filescan.io/uploads/649e856c204315fbc16bbfb1/reports/d3cfffc5-d672-4ab8-8580-e0953cc9a5b5/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/5d027c381ddadd04a2394bb9472793cf50bc9722db79419b7d9f2d7fd64a4fc5

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/0f43835a-9eae-4be5-ba37-2d1cc177d0d2

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1263699

Signature

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Antivirus detection for dropped file

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5d027c381ddadd04a2394bb9472793cf50bc9722db79419b7d9f2d7fd64a4fc5/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.Barys

Threat name:

ByteCode-MSIL.Trojan.Barys

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-18 18:57:37 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

3

AV detection:

21 of 24 (87.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lubhyoa53loqjirzjo4uoj4tz5ilzfzc3n4udg35t4wx7vskj7cq._file

Threatray malicious

Verdict:

malicious

Similar samples:

0baf82e29d938f8ce86d56784d4249181155983eecbfdae1f7324705b152da7b

Phonk

25db06aabf72392be5659c5e97f6202affc2601f2a49d37e73bd534d05f5b275

Phonk

635af14d9da60481f1811a34fd34382e6afa72eac2f4b10ae776f9c8560696eb

Phonk

6aa12fc8b880af7f1ba4edc944be0cc79a0cc4b58adc5439c4263870531b61d2

Phonk

85c5a9b53be051fef06d1082abb950a731ffb452e68cc9aafa907251e2d6bd72

Phonk

db926403044468770e30a5d653fb83c5b262f91682ce6553ee32287c02753c4f

Phonk

e1c3e42f794ea8db905580fa5ac184a3d06cba1ab0ac47d6bd686c24fe0b6c99

Phonk

+ 2'971 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230630-jd4gzahd5w/

Behaviour

Creates scheduled task(s)

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UnpacMe

Unpacked files

SH256 hash:

5d027c381ddadd04a2394bb9472793cf50bc9722db79419b7d9f2d7fd64a4fc5

MD5 hash:

a05d14aafaec11098f00629a5fcfc8af

SHA1 hash:

c0d07cf180ed045b4252a506fa8eb956455caca8

Link:

https://www.unpac.me/results/d31e6e95-64fb-466f-9b77-96c973e1e7bd/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5d027c381dda/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/403976/