MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e46dde6a0498a8132a2c3f67274c7da0957bd91b20be8399b9ed685332afb23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e46dde6a0498a8132a2c3f67274c7da0957bd91b20be8399b9ed685332afb23
SHA3-384 hash: 4be78c4382f458a9de9f7b1a4078b638a9318dade11a3d8b36d8ded66d9895ab7ff726885dedceae0211f35db177b086
SHA1 hash: c6674118a10232ec99cc50a5afe0388387ced232
MD5 hash: 5998ff85213b0d5f6c74464db0da2937
humanhash: september-sad-bravo-nebraska
File name:csrss.exe
Download: download sample
File size:843'264 bytes
First seen:2023-02-23 09:15:05 UTC
Last seen:2023-02-23 10:27:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:5wsssuk39IZqFIeYg7w8wtPX+A34yCtcu:ZssPIZ2Ies8wEA
Threatray 65 similar samples on MalwareBazaar
TLSH T14A057B46BBF09076F99E41AD063912CF1E31B253765CE22A5F3B78489D4AEFBB1C8111
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter Marco_Ramilli
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
206
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
csrss.exe
Verdict:
No threats detected
Analysis date:
2023-02-23 09:30:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8cc47579-9702-4dd5-a5b7-12adf5f839a4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/369233/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63f72ed5d385ee58585162dd/reports/d861ca43-74cf-4b8d-ac42-62e909e395da/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/5e46dde6a0498a8132a2c3f67274c7da0957bd91b20be8399b9ed685332afb23
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/25023152-d21f-4725-bde3-7683dbde42bf
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1181173
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e46dde6a0498a8132a2c3f67274c7da0957bd91b20be8399b9ed685332afb23/
Threat name:
Win32.Trojan.Startun
Create hunting rule
Status:
Malicious
First seen:
2023-02-23 09:16:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
30
AV detection:
20 of 25 (80.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lzdn3zvajgficmvcyp3he5gh3ievppmrwif6qom3t3likmzk7mrq._file
Verdict:
malicious
Similar samples:
042732c562dfd471de5faa3297e81ff23239515ac87d190a525b556d14342538
071eb944862ebe1d549a43b3ada9bad840b5b5cfa6b0af60fb56047b15998b35
39b1f0062671054c08424c70f2251c9c1c1f43bb87f12a95a44ad3b531d2c496
69e0ff8d0af4ba0a6a027aea1fa32d52d321ad1b9a4f1da70d7f9b40422c4a0e
6fc39fae12e7820ebca91a201bca578afd3c9b02539f42927cec1d61f362827c
8e450907def2cfc2f48a9ba638a915b8ccb4f2aba411e04d32ffab9e5f61a297
9b1aa498a16cf478562274d57611677ef226c09aa64b878c6e597cb8c2471a3b
ae3280531b573e9950f18d0a9b42d413c02ad56bb0ce24787be51ed45671d2ad
b84878e7bdf4123a1c96713885956003153ed5a09570d168ea4f73f9ead64ff6
b932e7ec61f1cc9b3c858a55eb883accf378580572077c2676adcf2a0aa8dde1
+ 55 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230223-k8ggcsfd54/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
b2dd5bcf9138720f9ffeca3b8aefa001e40b2dd879c1db3bb8e47281c3575f8e
MD5 hash:
301d49f143b4559eebb04d6604c9c806
SHA1 hash:
8e1065918d606bf77bf8d0fd3375de5c1e4ec0b3
Link:
https://www.unpac.me/results/bdd51a67-e7d9-456c-a05e-699ca20edf01/
SH256 hash:
8617cea503c2a3961120a9c503d853bc21d38d1fca7143d6b1ef4f388bc5cec7
MD5 hash:
7f225c69df031bf0560aed3847a1221a
SHA1 hash:
4d5f3ccdb2c6015d2b2a73326c0f32b173af2819
Link:
https://www.unpac.me/results/bdd51a67-e7d9-456c-a05e-699ca20edf01/
SH256 hash:
5e46dde6a0498a8132a2c3f67274c7da0957bd91b20be8399b9ed685332afb23
MD5 hash:
5998ff85213b0d5f6c74464db0da2937
SHA1 hash:
c6674118a10232ec99cc50a5afe0388387ced232
Link:
https://www.unpac.me/results/bdd51a67-e7d9-456c-a05e-699ca20edf01/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e46dde6a0498a8132a2c3f67274c7da0957bd91b20be8399b9ed685332afb23

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/369233/

Comments