MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63c4a15cd773f238eff00aa96951811734883b01d9460389aee9cdbe3edc437b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63c4a15cd773f238eff00aa96951811734883b01d9460389aee9cdbe3edc437b
SHA3-384 hash: bee4decfb084d475274884af133a0f0bdd5331e918fd659394a6ff91ba6a84d66fe707fbab15dba40a6b0e0418bc2090
SHA1 hash: 852af2699766e70313e5e53cbb7160426f43b736
MD5 hash: 471ac47ad3de3d7a3de0a0a835ca8753
humanhash: don-batman-moon-video
File name:471ac47ad3de3d7a3de0a0a835ca8753
Download: download sample
File size:2'636'209 bytes
First seen:2023-08-13 19:17:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fa8d20faea9ef7b4e2b7fbfe93442593 (17 x RedLineStealer, 4 x CoinMiner, 3 x AgentTesla)
ssdeep 49152:qDkUjjPGipmiSC/Rmcaz/4fxqhooOkC9ErmBLFh2YCNVUW9coaNnNv:q4UXGcv6wJq2t9T9F1AVn76nNv
Threatray 81 similar samples on MalwareBazaar
TLSH T10AC52311B9C1C170D6A62C751AE9A7217F3CBC105F3A8EDFA7881B2E5E306C19A34767
TrID 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10523/12/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter zbetcheckin
Tags:32 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
378
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
471ac47ad3de3d7a3de0a0a835ca8753
Verdict:
Suspicious activity
Analysis date:
2023-08-13 19:18:56 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b6f48535-cfa0-4e11-9eb3-dcff0aea9f83

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/442526/
Detection(s):
SecuriteInfo.com.Trojan.Uztuby.4.19274.32072.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/102789/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/63c4a15cd773f238eff00aa96951811734883b01d9460389aee9cdbe3edc437b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/70658482-e7bd-4560-8542-6bf728d51165
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1290698
Signature
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63c4a15cd773f238eff00aa96951811734883b01d9460389aee9cdbe3edc437b/
Threat name:
Win32.Trojan.Uztuby
Create hunting rule
Status:
Malicious
First seen:
2023-08-13 19:18:07 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mpckcxgxopzdr37qbkuwsumbc42iqoyb3fdahcno5hg34pw4in5q._file
Verdict:
unknown
Similar samples:
0d4a17711752aa245d338d3615b03711d45ae7cb25933b15e3e69de198731358
1b57f88dd88cf59b0f9aa09f1f4dd393c6b787f70afa9b6b111861d1a10af6a7
2646dd01581c1813f0478a25051ca4edac5e5c4fedcbd1ac0b4ca758426ec52d
427b5d1b32a8e17b94097a085094afcf86e857dcc8db0fd0b4bf7c50e6f3f349
4c6359593885cdae14233966dd15cd5b0fa207b97b4bf13c0817f2e124b07630
71a7be17ce0aa73dc1b2a2e353bc5ac7bc8e401f74c2681b4348650caf13d82b
9caad784222d3fb486822446983ef20eb408845146c9bf954bf2e185fb4e35d1
b4c2ff718a6f5c872387c54960848ea4798b78ac9ea50928106cf66a4bdffeb1
b8a047e3cd4389b70d5328f8828567ecfd7d308aaa8023f27d2eae441c8b2c05
df4f2bd477daed3aa0c4665f2b989157fa971af504981ebd35c4af660d82ccb1
+ 71 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230813-xzxs7sfh6s/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Unpacked files
SH256 hash:
63c4a15cd773f238eff00aa96951811734883b01d9460389aee9cdbe3edc437b
MD5 hash:
471ac47ad3de3d7a3de0a0a835ca8753
SHA1 hash:
852af2699766e70313e5e53cbb7160426f43b736
Link:
https://www.unpac.me/results/401efb54-c50d-41c3-94f2-3bf5424073bc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/63c4a15cd773f238eff00aa96951811734883b01d9460389aee9cdbe3edc437b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 63c4a15cd773f238eff00aa96951811734883b01d9460389aee9cdbe3edc437b

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2704311/
Cape
Cape
https://www.capesandbox.com/analysis/442526/

Comments


Avatar
zbet commented on 2023-08-13 19:17:37 UTC

url : hxxp://77.91.68.3/fuzz/kaman.exe