MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 621073c2fd07300a3d202b5801f3c17869f0aa73718033492ac986aafd9a897a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 621073c2fd07300a3d202b5801f3c17869f0aa73718033492ac986aafd9a897a
SHA3-384 hash: 02d34f773364b01193137fafb0cd786a8acb2d412a1bcdc513b99747a2287dfe70c54928b009c674fea189e06643c22e
SHA1 hash: e488375512598815d999c1b1c262342c0140298b
MD5 hash: 111cb53077982c5663366b1444d8cd1b
humanhash: alaska-charlie-snake-hawaii
File name:111cb53077982c5663366b1444d8cd1b.exe
Download: download sample
File size:14'533'120 bytes
First seen:2023-06-17 09:53:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 57c9b357ae0cb2f414b0a5873e2f216d
ssdeep 98304:TClrUORb2nth32ic3gefxEu/4/dd+oy+0Zg:TgoOt2nGxgeaf/dh
Threatray 209 similar samples on MalwareBazaar
TLSH T126E64A07E89191F5C4ADD170C6369262FA303C845F3067D73B64FAB92B32BE46A79394
gimphash ae00fe29899d7a434aedea7e4658ea3411301be6b959faa5e4c34f7953ea2eb1
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
258
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
https://productkeyforfree.com/adobe-premiere-pro-v23-1-0-886-metrologists-disable/
Verdict:
Malicious activity
Analysis date:
2023-06-16 09:48:01 UTC
Tags:
zgrat raccoon recordbreaker trojan loader stealer
Link:
https://app.any.run/tasks/b21e456a-2982-49fc-b562-182e909191f7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67536510.13404.8779.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Reading critical registry keys
Running batch commands
Launching a process
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug greyware
Link:
https://www.filescan.io/uploads/648d82bc05c2024e9fa01a55/reports/80ce78f5-f9fe-462b-9072-d65b16f3190e/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/621073c2fd07300a3d202b5801f3c17869f0aa73718033492ac986aafd9a897a
Result
Verdict:
MALICIOUS
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a2610bfa-7ed8-4806-a4d8-2c03c4f47d08
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1256439
Signature
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 889460 Sample: SE47NHNtf8.exe Startdate: 17/06/2023 Architecture: WINDOWS Score: 52 16 Multi AV Scanner detection for submitted file 2->16 7 SE47NHNtf8.exe 2->7         started        process3 signatures4 18 Tries to harvest and steal browser information (history, passwords, etc) 7->18 10 cmd.exe 1 7->10         started        process5 process6 12 conhost.exe 10->12         started        14 choice.exe 1 10->14         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/621073c2fd07300a3d202b5801f3c17869f0aa73718033492ac986aafd9a897a/
Threat name:
Win64.Spyware.Raccoonstealer
Create hunting rule
Status:
Malicious
First seen:
2023-06-15 15:33:59 UTC
File Type:
PE+ (Exe)
AV detection:
22 of 37 (59.46%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=miihhqx5a4yaupjafnmad46bpbu7bkttogadgsjkzgdkv7m2rf5a._file
Verdict:
malicious
Similar samples:
090c5cbe4133ef686f2c8ad8cc1a835d1be38162a3add01fd4b0a53c5ea8cc85
37f4de4ac5d64d68e8c468d06ccc1cee1142894dbd87e63a6a53a3098db6e747
3d9ffc27500e20102800e24fb92fda87c6228bd2cacc9a9c660442c84fa0ce18
558944fc2adfcd051a2f55cf18141d0b6e70282d51bb425e4035c09d39aac49a
59f6e559d4053e7b5358708d5c6ac677889ba5702ef8e71fb64bd11494cf5c58
68ec885eabd2ac076ea588d4cf827eaa83e518d5a4c0578ee73bf0daa4ef9b67
6ee6ee45d3ece9254facb6b715189ea03ede981438929fc56f77e691681a66a1
c0bdd07daeb73c3739f70f84b9ed6dda1c45c305ac3c9edb152c2ac07286a517
c76a3ac180addf9f1743159b4a66b12f313c4d59d9a7b1270a7877aa443a8804
c770b3a12fd153340bc59a93c422e133edffbc36f176aaf989311dea77e833d3
+ 199 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/230617-lw7nfsbc67/
Behaviour
Suspicious use of WriteProcessMemory
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
621073c2fd07300a3d202b5801f3c17869f0aa73718033492ac986aafd9a897a
MD5 hash:
111cb53077982c5663366b1444d8cd1b
SHA1 hash:
e488375512598815d999c1b1c262342c0140298b
Link:
https://www.unpac.me/results/3c095c15-74f3-43d3-9ffb-493a76199821/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/621073c2fd07300a3d202b5801f3c17869f0aa73718033492ac986aafd9a897a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 621073c2fd07300a3d202b5801f3c17869f0aa73718033492ac986aafd9a897a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2626800/
  
Delivery method
Distributed via web download

Comments