MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61b16d71a76f83cef63d079b0735cd0a1cee24f1119063e28ef1f227f2bb27c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61b16d71a76f83cef63d079b0735cd0a1cee24f1119063e28ef1f227f2bb27c4
SHA3-384 hash: 6adba467616bc395558ed73c0e76f000a5465a1f58cfdb3ebbb9b8d09f5c7b274ea87998150dc14fc06afceef4769d0c
SHA1 hash: 25d37cefc47ff57d77fd5f2107a2e352240ba592
MD5 hash: c4fdb47dbe7e674f342fe0e1cf4a5e3c
humanhash: floor-ohio-coffee-ack
File name:61b16d71a76f83cef63d079b0735cd0a1cee24f1119063e28ef1f227f2bb27c4
Download: download sample
File size:35'101'932 bytes
First seen:2022-11-30 08:08:33 UTC
Last seen:2022-11-30 09:30:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 69eb46a9f63edcc604b0bdaaa8e0f2f5 (2 x DCRat, 1 x Lazagne, 1 x RedLineStealer)
ssdeep 786432:/83FmzuS74vdQuvUUJad7cw0XDJ+OmqfaBdKoL7jx4Wpw8/Db5:E674v/UnUd+9qCb/x4Wh7
Threatray 67 similar samples on MalwareBazaar
TLSH T1CD77332BE5480DCAF2E8253788DBE534A351F844D769C60F8AC436A926E77D25933F34
TrID 33.3% (.EXE) Win64 Executable (generic) (10523/12/4)
31.6% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
15.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.4% (.EXE) OS/2 Executable (generic) (2029/13)
6.3% (.EXE) Generic Win/DOS Executable (2002/3)
dhash icon aebc385c4ce0e8f8 (10 x PythonStealer, 7 x RedLineStealer, 7 x DCRat)
Reporter struppigel
Tags:decksstealer decksteam exe frozen pyarmor


Avatar
struppigel
This malware is written in Python, converted to an EXE file with PyInstaller and protected by PyArmor.
The malware is so nice to tell us its name. "Decks Team INFO STEALER" and "Decks Team GRABBER" strings can be found in the code.

Intelligence

File Origin
# of uploads :
2
# of downloads :
458
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
61b16d71a76f83cef63d079b0735cd0a1cee24f1119063e28ef1f227f2bb27c4
Verdict:
No threats detected
Analysis date:
2022-11-30 08:09:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ad581897-fafb-4048-ba76-8857a2173589

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file
Running batch commands
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/63870fa000c584752ee2b09f/reports/cf6604f2-847e-4034-8c51-66093a972660/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1123729
Signature
Contains functionality to infect the boot sector
Hides threads from debuggers
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-11-19 22:40:40 UTC
File Type:
PE+ (Exe)
Extracted files:
3252
AV detection:
3 of 41 (7.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mgyw24nhn6b455r5a6nqononbioo4jhrcgighyuo6hzcp4v3e7ca._file
Verdict:
unknown
Similar samples:
1a2a1a33841d79dcaf62dfd71becddec0581a725793fb6119f187568ac351794
20632d113408af16371070219ed4e9f260a3cc23db39fcddce2580ebf6669b5f
29a0ec2958b900db46598043791f3b672c7c62cf3d0ebd44444c208d057d05ce
6ae3599bcbb951c7fe73ab6060a654b5ced2e83cf3ff15038bec95743232425e
88214cd533e440416cb5fec9e1a419ad952cd3524274110eaa8ce8e1dbcd826a
996c4e5418405912b929e7916def0a6c0aaedf77065ec5725f4782b00fb1464e
bf6915895b1bc041c3f1b89467b9b293385a3837d4cc59ac8a8d32adb0742ebe
c6af2ec456ad02b9eb3faf9fd9384d3dc43a55e7b1a58eec4440ee4bde1e99ce
+ 57 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller spyware stealer
Link:
https://tria.ge/reports/221130-j15csacb55/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c531321d-392a-4673-bfbc-184ad0848ca7
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/61b16d71a76f83cef63d079b0735cd0a1cee24f1119063e28ef1f227f2bb27c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments