MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fffca6c293a697890e7851f0d667cc44f37176e41ed1e7455aa7034f731b6f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fffca6c293a697890e7851f0d667cc44f37176e41ed1e7455aa7034f731b6f1
SHA3-384 hash: cf3b89f7c6313ed0e1f40900155e68e30c13595f7c1194c85dc37db50c84ad80dbab94f0a574d608f658c9c384356e80
SHA1 hash: c68b376f2431e43506505aa1318e3a3a18711f25
MD5 hash: f1f210003e563b1de26230b6e6091f84
humanhash: alpha-emma-sink-edward
File name:SecuriteInfo.com.Trojan.MulDrop14.2762.17284.16267
Download: download sample
File size:2'547'712 bytes
First seen:2023-10-24 21:29:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bf87df4e572bd4737499f53645f78505
ssdeep 24576:CSiyarKUYm50MSpiWw9mFQaKK6GfFTMP7hQQdZqmTwXCsMwu4Cz8AOFfv/CeBK+2:CSi7nYICKK6Gf5MiiZ+16Z9/T4DrInK
Threatray 1 similar samples on MalwareBazaar
TLSH T13CC59E51FB49C065F1920530C0E75B758B64BDA6B3289DE767903E28AE722C23E3D61F
TrID 47.6% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
19.8% (.EXE) Win32 Executable Microsoft Visual Basic 6 (82067/2/8)
10.4% (.EXE) InstallShield setup (43053/19/16)
7.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
3.1% (.SCR) Windows screen saver (13097/50/3)
File icon (PE):PE icon
dhash icon d4d6f5b23717d233
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
320
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.MulDrop14.2762.17284.16267
Verdict:
Malicious activity
Analysis date:
2023-10-24 21:31:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4f1b027a-240b-4243-a1d4-ab5b42a738fe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/456078/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.MulDrop14.2762.17284.16267.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for the window
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Creating a process from a recently created file
Creating a file
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm control explorer greyware icedid keylogger lolbin packed regsvr32 remote replace setupapi shell32 whirlpool
Link:
https://www.filescan.io/uploads/653837674678fc28dfc95da4/reports/4657da10-ff1e-4390-bd02-f8c4a959575a/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/5fffca6c293a697890e7851f0d667cc44f37176e41ed1e7455aa7034f731b6f1
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/adc68172-a15e-4dab-8208-fef8e623bc4c
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1331532
Signature
Contains functionality to detect virtual machines (IN, VMware)
Sample uses string decryption to hide its real strings
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1331532 Sample: SecuriteInfo.com.Trojan.Mul... Startdate: 24/10/2023 Architecture: WINDOWS Score: 48 59 Sample uses string decryption to hide its real strings 2->59 9 SecuriteInfo.com.Trojan.MulDrop14.2762.17284.16267.exe 3 2->9         started        process3 file4 45 C:\Users\user\AppData\Local\...\cpuz160.exe, PE32 9->45 dropped 12 cpuz160.exe 9->12         started        15 regsvr32.exe 9->15         started        17 regsvr32.exe 9->17         started        process5 signatures6 61 Contains functionality to detect virtual machines (IN, VMware) 12->61 19 pcaui.exe 12 12->19         started        process7 process8 21 chrome.exe 9 19->21         started        24 chrome.exe 19->24         started        26 chrome.exe 19->26         started        28 35 other processes 19->28 dnsIp9 47 192.168.2.16 unknown unknown 21->47 49 192.168.2.3 unknown unknown 21->49 51 4 other IPs or domains 21->51 30 chrome.exe 21->30         started        33 chrome.exe 24->33         started        35 chrome.exe 26->35         started        37 chrome.exe 28->37         started        39 chrome.exe 28->39         started        41 chrome.exe 28->41         started        43 32 other processes 28->43 process10 dnsIp11 53 13.107.226.40, 443, 49757, 49817 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 30->53 55 part-0007.t-0009.fb-t-msedge.net 13.107.253.35, 443, 50899 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 30->55 57 30 other IPs or domains 30->57
Score:
85%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5fffca6c293a697890e7851f0d667cc44f37176e41ed1e7455aa7034f731b6f1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5fffca6c293a697890e7851f0d667cc44f37176e41ed1e7455aa7034f731b6f1/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l774u3bjhjuxrehhqupq2zt4yrhtof3oihwr45cvvjydj5zrw3yq._file
Verdict:
unknown
Similar samples:
9811bb8cb59546ea8be63da7368895c983b335b775e9c18f29da771358f28c82
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231024-1ch83sba6z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
42ebe34ca6551df68dbb7c43633b82ce49c0f7faf2fbd59ae9242d453ecbbf50
MD5 hash:
fd87b24a68854e3c4ec038debef1c4e3
SHA1 hash:
549a1da4c8fe229e1558b97a3c32c2829d762a2b
Link:
https://www.unpac.me/results/75520543-60d5-4356-b347-15d1d0ad19ed/
SH256 hash:
4f493ee0230766a3b2564f3d81c5f8cf9de42f0aecb86772edb03bdf62e1ce9e
MD5 hash:
46a98f90c410f6e5b2bdc33e31953d0c
SHA1 hash:
70b166f892947ba681aa7dc0e13e73d5793b6239
Link:
https://www.unpac.me/results/75520543-60d5-4356-b347-15d1d0ad19ed/
SH256 hash:
5fffca6c293a697890e7851f0d667cc44f37176e41ed1e7455aa7034f731b6f1
MD5 hash:
f1f210003e563b1de26230b6e6091f84
SHA1 hash:
c68b376f2431e43506505aa1318e3a3a18711f25
Link:
https://www.unpac.me/results/75520543-60d5-4356-b347-15d1d0ad19ed/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/456078/

Comments