MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e0c028b051b4ce3b7547ae6bc41ce820a68646328ed7eaeab95734680e4ae68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkTortilla


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e0c028b051b4ce3b7547ae6bc41ce820a68646328ed7eaeab95734680e4ae68
SHA3-384 hash: 539fa972327498fd878adda2e4bc65e23edadf2874003aa0393e041c1228a94f1ac96c7cc0acf9086fed87192731d4b7
SHA1 hash: 05cfbe2737357b94d7a4a9b7ad5424030698e4c4
MD5 hash: 8aa84b467d8a13138ba9922b21d75661
humanhash: jig-solar-kentucky-oven
File name:8aa84b467d8a13138ba9922b21d75661
Download: download sample
Signature DarkTortilla
Create hunting rule
File size:1'154'560 bytes
First seen:2023-09-08 15:49:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:fjGVDKLZNs5S9c5VaNZPFeKhp9Emtb48Zmr3:fOuW5ScKPoKhpj
Threatray 1'160 similar samples on MalwareBazaar
TLSH T1283512ABAF86A4A1DAADA772402E245873F0E5CB2D63C10E41CB41A5DF773D9DD0314B
TrID 60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.8% (.SCR) Windows screen saver (13097/50/3)
8.7% (.EXE) Win64 Executable (generic) (10523/12/4)
5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter zbetcheckin
Tags:32 DarkTortilla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
297
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8aa84b467d8a13138ba9922b21d75661
Verdict:
Malicious activity
Analysis date:
2023-09-08 16:09:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/eb7d3d83-a0cd-452e-b8e1-3c7b030861cb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/447550/
Detection(s):
SecuriteInfo.com.Win32.RansomX-gen.21821.20536.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/5e0c028b051b4ce3b7547ae6bc41ce820a68646328ed7eaeab95734680e4ae68
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7c1e9060-286f-42d2-a863-bed8b9428ab3
Result
Threat name:
DarkTortilla
Create hunting rule
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1306365
Signature
.NET source code contains very large array initializations
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected DarkTortilla Crypter
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1306365 Sample: TeuwGfPYuF.exe Startdate: 08/09/2023 Architecture: WINDOWS Score: 96 33 Multi AV Scanner detection for submitted file 2->33 35 Yara detected DarkTortilla Crypter 2->35 37 Yara detected AntiVM3 2->37 39 2 other signatures 2->39 8 MustFlush.exe 4 2->8         started        11 TeuwGfPYuF.exe 4 2->11         started        process3 signatures4 41 Multi AV Scanner detection for dropped file 8->41 43 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 8->43 45 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->45 13 MustFlush.exe 2 8->13         started        16 conhost.exe 8->16         started        18 MustFlush.exe 8->18         started        20 MustFlush.exe 8->20         started        47 Injects a PE file into a foreign processes 11->47 22 TeuwGfPYuF.exe 6 11->22         started        25 conhost.exe 11->25         started        process5 file6 49 Writes to foreign memory regions 13->49 51 Injects a PE file into a foreign processes 13->51 27 InstallUtil.exe 2 13->27         started        31 C:\Users\user\AppData\Local\...\MustFlush.exe, PE32 22->31 dropped signatures7 process8 process9 29 conhost.exe 27->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e0c028b051b4ce3b7547ae6bc41ce820a68646328ed7eaeab95734680e4ae68/
Threat name:
ByteCode-MSIL.Trojan.DarkTortilla
Create hunting rule
Status:
Malicious
First seen:
2023-09-08 15:50:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
36
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lygafcyfdngohn2upltlyqooqifgqzddfdwx5lvlsvzunahevzua._file
Verdict:
malicious
Similar samples:
0a2a3e6eb5d920e00c424039f54ad1b9f66ecf1c7f854c544e9b2e22d153c9ed
DarkTortilla
1ea413a774d50a0780285ae1fb0d85020be08e16cf2dedd167bbf6f966532d5c
DarkTortilla
1f9608369e65dd661a77e6f7ba62ff9435061a7be179bd1602a55893e754e1cc
DarkTortilla
29f5a8629986da0b4a353e5423fb39c505cba7c06e7aa4b5a4029c5a1669ae95
DarkTortilla
59a5e46b3173bc33c36e91ea80c13771e4f760011e59d360f84070b72ebb28d0
DarkTortilla
641f9c7dc1b782b4eaa9f840977b3a37ffc121068e0602b7ebd13f2d1f83c86b
DarkTortilla
8dc089fd8fa7592e92ae50e19b2be9778db70fa4ca84af6f8dda27af4851faf5
DarkTortilla
e3725f57d26d63fa6e326e5cc622d408ebb6eb9c2d7468eb34c3b79f42c07169
DarkTortilla
f7891fb963a90cb5f84fdd754b0c7d1e54c3945c1d84bf52ff989712e5139422
DarkTortilla
+ 1'150 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230908-s9xhzadd34/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Executes dropped EXE
Unpacked files
SH256 hash:
720eb7865aa32950f28737087178ab60b13de358aeb838ede500c50f7235cc69
MD5 hash:
59ff3aedb3f9df07f7ed61aeec39d6d7
SHA1 hash:
d3df5789a205f7849ae626045f6fdb5a7a80da7e
Link:
https://www.unpac.me/results/90b24a34-8d48-4e3f-b5c5-6c514bf8aa4c/
SH256 hash:
e5183c595242ee6a7b57ed5b0f9d09636eb89c2813f72ea2b391e7a275e57096
MD5 hash:
3a4c9d009a1544485b0ae46795d6b9be
SHA1 hash:
cb8d8c9753849e6631f54df598cbbc6e8639c9f5
Link:
https://www.unpac.me/results/90b24a34-8d48-4e3f-b5c5-6c514bf8aa4c/
SH256 hash:
5e0c028b051b4ce3b7547ae6bc41ce820a68646328ed7eaeab95734680e4ae68
MD5 hash:
8aa84b467d8a13138ba9922b21d75661
SHA1 hash:
05cfbe2737357b94d7a4a9b7ad5424030698e4c4
Link:
https://www.unpac.me/results/90b24a34-8d48-4e3f-b5c5-6c514bf8aa4c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e0c028b051b4ce3b7547ae6bc41ce820a68646328ed7eaeab95734680e4ae68

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkTortilla

Executable exe 5e0c028b051b4ce3b7547ae6bc41ce820a68646328ed7eaeab95734680e4ae68

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/447550/
  
URLhaus
https://urlhaus.abuse.ch/url/2710602/
  
URLhaus
https://urlhaus.abuse.ch/url/2710797/

Comments


Avatar
zbet commented on 2023-09-08 15:49:45 UTC

url : hxxp://81.161.229.120/raw/update/1iexpress.exe