MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5d0f7eef2abb45c37ccb67da3a533a1428f1059693ee6a8d04be62e4b085b0dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 13
| SHA256 hash: | 5d0f7eef2abb45c37ccb67da3a533a1428f1059693ee6a8d04be62e4b085b0dc |
|---|---|
| SHA3-384 hash: | 9cbc1887ea098b565e8dfb66f7c8f6068ffdbf7a66a5b12736c15b797b3344a9a59cf96835d19b1bda185855544c463d |
| SHA1 hash: | 8a08e0c458c5595291062815a5dff0780a51aab5 |
| MD5 hash: | e122bdd24bfe5c90f219bfce30e07abe |
| humanhash: | steak-fourteen-spaghetti-ink |
| File name: | SecuriteInfo.com.W32.MSIL_Kryptik.KHA.gen.Eldorado.23475.14431 |
| Download: | download sample |
| File size: | 2'424'832 bytes |
| First seen: | 2024-08-14 21:20:55 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 49152:+rqn0KQfFn7LyKIw05HsHvBuNdVWkmyELfKWlB+gblUQqGPxBr:IVn3Iw05HuBunkHfiWj+OlC2j |
| Threatray | 249 similar samples on MalwareBazaar |
| TLSH | T174B5CE03B947CAB2E2481736C59B470473E7DA8173ABDA1B798EA3A615433FBDD01607 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
499
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Iruhlovp.exe
Verdict:
Suspicious activity
Analysis date:
2024-08-14 19:09:02 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
92.5%
Tags:
Heur
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
net_reactor packed packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
96 / 100
Signature
.NET source code contains potential unpacker
AI detected suspicious sample
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Generic
Status:
Malicious
First seen:
2024-08-14 08:49:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
19 of 38 (50.00%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 239 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
discovery persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
326dd716fb96449a1a4ff12e1e607fecc4df3466fa9b3132e6b7cc786b5d54a6
MD5 hash:
6030456f88cc6284feb00202bebee771
SHA1 hash:
53dcc264185295501083d24ee7e3b5262a0a6d87
SH256 hash:
19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372
MD5 hash:
4e29f75c0c51b9dec76955f0382d9541
SHA1 hash:
4899aa8e3f57339cbaec8faab777897a76fe1c3a
SH256 hash:
777475295993980937b2c63632fcabcae7d354e1284f3fa39419b7a8e9f1066f
MD5 hash:
677e7aac9a987cc6d965e7ed72630870
SHA1 hash:
3e067c0b798e00949a213e0b168cce49f7a1cdd3
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
5d0f7eef2abb45c37ccb67da3a533a1428f1059693ee6a8d04be62e4b085b0dc
MD5 hash:
e122bdd24bfe5c90f219bfce30e07abe
SHA1 hash:
8a08e0c458c5595291062815a5dff0780a51aab5
Detections:
SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (GUARD_CF) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.