MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d45948167c781bc6167406bf9b8f97f4fea8d976581c6c5130d9ee5a2b11831. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d45948167c781bc6167406bf9b8f97f4fea8d976581c6c5130d9ee5a2b11831
SHA3-384 hash: 37806939afdb4336df09acfe74555b7dcae3c4d993bad7ec64ceb1930c416ccfdc8961cf222fb925a92709258bb93f76
SHA1 hash: 51fb7432ef468a1f21044a548b438de270562b7d
MD5 hash: 314adeb29cb735d26f34701b5800b4e8
humanhash: mockingbird-vegan-hamper-hotel
File name:314adeb29cb735d26f34701b5800b4e8
Download: download sample
File size:1'044'480 bytes
First seen:2023-03-02 06:55:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 24576:RorVBwSvSy77ok94IizVCHHFeuHP+7yagg:Roh3Ik947zVCHQQoyag
Threatray 243 similar samples on MalwareBazaar
TLSH T14625224BAB2384E1E1454AB2FCE27B0A2BB1C4B6049767130CDEDCF4661EB9A3C555DC
TrID 56.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:314adeb29cb735d26f34701b5800b4e8 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
314adeb29cb735d26f34701b5800b4e8
Verdict:
Malicious activity
Analysis date:
2023-03-02 06:57:43 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9586d78b-63db-4015-a897-2167706b567a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/371013/
Detection(s):
Win.Trojan.EmbeddedDotNetBinary-9940868-0
Create hunting rule

Win.Trojan.EmbeddedReversedDLL-9940922-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Creating a file
Launching the default Windows debugger (dwwin.exe)
Forced system process termination
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed scar
Link:
https://www.filescan.io/uploads/64004883bbedb8176ff222e8/reports/3faf8793-e923-4f7b-87d2-104c0a07ac78/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/5d45948167c781bc6167406bf9b8f97f4fea8d976581c6c5130d9ee5a2b11831
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/911521f0-d78b-41f4-a3aa-4d8e1e19e815
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1185451
Signature
Encrypted powershell cmdline option found
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 818307 Sample: dtQRwWzKHu.exe Startdate: 02/03/2023 Architecture: WINDOWS Score: 76 37 windowsupdater64x.theworkpc.com 2->37 41 Multi AV Scanner detection for submitted file 2->41 43 Machine Learning detection for sample 2->43 8 dtQRwWzKHu.exe 8 2->8         started        12 hyygb.exe 5 2->12         started        signatures3 process4 dnsIp5 33 C:\Users\user\AppData\Local\...\hyygb.exe, PE32+ 8->33 dropped 35 C:\Users\user\...\hyygb.exe:Zone.Identifier, ASCII 8->35 dropped 45 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 8->45 47 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->47 15 cmd.exe 1 8->15         started        18 WerFault.exe 21 9 8->18         started        39 windowsupdater64x.theworkpc.com 193.42.33.27, 49705, 49706, 49707 EENET-ASEE Germany 12->39 49 Multi AV Scanner detection for dropped file 12->49 51 Machine Learning detection for dropped file 12->51 21 cmd.exe 12->21         started        file6 signatures7 process8 file9 53 Encrypted powershell cmdline option found 15->53 23 powershell.exe 17 15->23         started        25 conhost.exe 15->25         started        31 C:\ProgramData\Microsoft\...\Report.wer, Unicode 18->31 dropped 27 conhost.exe 21->27         started        29 powershell.exe 21->29         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d45948167c781bc6167406bf9b8f97f4fea8d976581c6c5130d9ee5a2b11831/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-03-02 06:56:09 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
3
AV detection:
14 of 39 (35.90%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lvczjalhy6a3yylhibv7tohzp5h6vdmxmwa4nritbwpolivrdayq._file
Verdict:
malicious
Similar samples:
46b6798990aefaedd162220d0593c6b22aa72fa3afc71ad4b12d6781793a9e06
5795e1e656eef516e884bcf0b57dfdccd24863893a5804532125242df09dc07b
5e6776ba02afa4c03138edcdf1e10dabee3efd6afd1620dcdb3138e7632bcb79
668eb4590a79e6a228f5048fe1736e40dce34034398cf762e6c6ba42599cb8e7
6c24b32fd580fa85a208580f508f497330a5adca6859a4c93cdeefb720049cb1
c180f58783642d9688ad20f32ce72e504accf1d101f1591b39b0d4e0f429fe3f
ca4033db02bded2739ca4e31c72910e4c5995f9437cda0c4767a8113166d84b6
ffe2e43e59074cf27875cc31e8be84503b1a6854dd3f2480b5aff7b6b220a416
+ 233 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230302-hqcdksbd8v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Program crash
Drops file in System32 directory
Checks computer location settings
Unpacked files
SH256 hash:
5d45948167c781bc6167406bf9b8f97f4fea8d976581c6c5130d9ee5a2b11831
MD5 hash:
314adeb29cb735d26f34701b5800b4e8
SHA1 hash:
51fb7432ef468a1f21044a548b438de270562b7d
Link:
https://www.unpac.me/results/48581cdc-bd64-4ef4-9583-8ad459589d9b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/5d45948167c781bc6167406bf9b8f97f4fea8d976581c6c5130d9ee5a2b11831

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:Typical_Malware_String_Transforms
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:Typical_Malware_String_Transforms_RID3473
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/371013/

Comments