MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 601bb366b3a928942a881856cf553928854a1083d7018720a295d76fd51f3032. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 601bb366b3a928942a881856cf553928854a1083d7018720a295d76fd51f3032
SHA3-384 hash: a1db81b02b79c84f0f2621a8f108090e4dfb656f81025f4e2a196ce744127e1a9668741f3e95d74b467ec85986eee903
SHA1 hash: 48559e89718ecd26582c3ea28307e811ecb8441d
MD5 hash: 348e46112e0aa9789d7fcd58f1341cb4
humanhash: arizona-island-crazy-five
File name:FacturaEndeFecha25102021.msi
Download: download sample
File size:2'377'216 bytes
First seen:2021-10-26 08:35:20 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 24576:HSpe5GYMfchXGgThayIW5ALx5IOxAnNEcY8bRNB7s0swUW/6in06O4brDeTU+1Ep:HS8GY2OWLhxwNEc/R35SGraTP13A
Threatray 240 similar samples on MalwareBazaar
TLSH T1E3B58E12F2D34537D1731B388D5B93699839BE502E38A84B2BE93D4C5F396813D292D7
Reporter abuse_ch
Tags:msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/200112/
Detection(s):
SecuriteInfo.com.RDMK.cmRtazpKxKzi0pVLtXUmAmezzdjf.17904.UNOFFICIAL
Create hunting rule

Win.Downloader.Zusy-9884239-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
dde
Link:
https://www.filescan.io/uploads/6177bdfb9a5a1e91c5d436e0/reports/b98a114c-6ce5-4640-afbd-284c653ce3ea/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/601bb366b3a928942a881856cf553928854a1083d7018720a295d76fd51f3032
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
5 / 100
Link:
https://www.joesandbox.com/analysis/876828
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/601bb366b3a928942a881856cf553928854a1083d7018720a295d76fd51f3032/
Threat name:
Win32.Downloader.BanLoad
Create hunting rule
Status:
Malicious
First seen:
2021-10-26 08:36:11 UTC
AV detection:
10 of 44 (22.73%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=man3gzvtveujikuidblm6vjzfccuueed24ayoifcsxlw7vi7gaza._file
Verdict:
malicious
Similar samples:
205c9f62e617e1c619fe35d67be5af588f3d60e0a1f17aff17918de1ef285342
2964fb55787de6bcba3eeb420da1036853baf6b528b75e751476d790b8fcadf6
3b9206b984f54cb89202e530be9ad8d10a97d7ae1b3dbaa557477e6056775406
416b4fab85b707b12f4bce28529a496828c4f1dc5fd5e45492eba0f3d2730e90
472e40357bbd9c18824abf10157d6482b8d853cdef7267b723e5d887b54e00ee
6cc12dfea6cb56664ffe532065778cb8b4e8bccb4d7bf796c0d8a008702aceda
9cd951344ff2f9e7f06f5768402c2f1c2932e29535facbfadce48cfa1aad0b23
9f0d3b49b6eea3eff22dce2838b10e8e3b03c45f31212f8d26ae31cd576f1104
cf7050100e621e4f4373ae9052590b08b398cb8c3939660124137d693f966231
f93fa1798eb2e1fd2a116ecf95b17058491c58c026f739ee90da13cd2c02f754
+ 230 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/211026-khl9xshac7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Enumerates connected drives
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.85
Link:
https://yomi.yoroi.company/submissions/601bb366b3a928942a881856cf553928854a1083d7018720a295d76fd51f3032

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/200112/

Comments