MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036
SHA3-384 hash: d229c67df35597c068469f2919f396d379143ebaf530ff136800dc3fb826524a71f1f5776093fac2e73923be4c125ee1
SHA1 hash: c6e9c301d3cfaf6671490c47c1ed4eb59f343f21
MD5 hash: 13db34cab435d9858269c5e823f4b575
humanhash: uncle-wyoming-ten-illinois
File name:13db34cab435d9858269c5e823f4b575.exe
Download: download sample
File size:1'212'928 bytes
First seen:2021-04-08 08:15:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:hf18kqE2AHyyNAtU7FYrOdwSwIZJLQJlmHyYhGwzee5DT:RykQ8AtU7DaIZJL6ayYNzeexT
Threatray 552 similar samples on MalwareBazaar
TLSH 614512727189C888C05584B2C69FA14643BDFCD57893CB23664DB30AB43DB8D9DC6EDA
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Pack of viruses.zip
Verdict:
Malicious activity
Analysis date:
2021-04-07 23:23:45 UTC
Tags:
trojan ransomware
Link:
https://app.any.run/tasks/f8a944fe-898e-4d74-98ee-765c8a71b997

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/133102/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file
Sending an HTTP POST request
DNS request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Sending an HTTP GET request
Creating a process from a recently created file
Unauthorized injection to a recently created process
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/670005
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for URL or domain
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 383949 Sample: TE1bWe4Jz2.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 42 Antivirus detection for URL or domain 2->42 44 Sigma detected: Scheduled temp file as task from temp location 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 6 other signatures 2->48 9 TE1bWe4Jz2.exe 3 2->9         started        process3 file4 32 C:\Users\user\AppData\...\TE1bWe4Jz2.exe.log, ASCII 9->32 dropped 58 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->58 60 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 9->60 62 Injects a PE file into a foreign processes 9->62 13 TE1bWe4Jz2.exe 15 30 9->13         started        signatures5 process6 dnsIp7 36 api.ip.sb 13->36 38 217.12.209.28, 44444, 49713, 49715 ITLDC-NLUA Ukraine 13->38 40 2 other IPs or domains 13->40 34 C:\Users\user\AppData\Local\Temp\svclip.exe, PE32 13->34 dropped 64 Tries to harvest and steal browser information (history, passwords, etc) 13->64 66 Tries to steal Crypto Currency Wallets 13->66 18 svclip.exe 6 13->18         started        file8 signatures9 process10 file11 28 C:\Users\user\AppData\...\ssWeviPUYoTiS.exe, PE32 18->28 dropped 30 C:\Users\user\AppData\Local\...\tmpFE53.tmp, XML 18->30 dropped 50 Machine Learning detection for dropped file 18->50 52 Uses schtasks.exe or at.exe to add and modify task schedules 18->52 54 Writes to foreign memory regions 18->54 56 2 other signatures 18->56 22 schtasks.exe 1 18->22         started        24 RegSvcs.exe 2 18->24         started        signatures12 process13 process14 26 conhost.exe 22->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036/
Threat name:
ByteCode-MSIL.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 09:44:26 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0e9f18832b1738b5db30853fc3732e4a083722f7d99db5e62c8dc3d42e5cae70
1be887ab809f4d5f443d78ee02427954aaf63365be283fec335902ac48ba4445
1cc84d3c06c9a283218310ac6d69e7161fd7605339b78035747c6f51021475ff
20000a9d0078fa18b60d9ad52d36b4f5dfa77d2f74866e8793ee0085ab0c9964
4951d233fb87fd6036e0baadf6b91ceb91ebe5d61fc048a27949949c8476b82d
50e7b9a736f734ffd4d57d93f93a89e454a4e5147ec7dac2c3f3e5f5fee6fd5f
7797da9505bd2ab985d9b1233977b6b11ab9f0e8da31a47b44e0af23c94af807
90df3103315b6a7d1f7e24176ba6bfe297882289dadb21c5d4e3c0a20a5732c1
a8534e310ee42756cfc01caf1eeddc8f4bca6e7e7f36de1a90f5c6ccc480e90a
f1c317dfe16f1857fe9df96ce966a07d3ca86680c39ae8e892277b78995cceb3
+ 542 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/210408-5qqwk1hre2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
0a297b3d0bbd905f6d88be97b0b8ec8b84bafb3773543065445d6bc1794d055f
MD5 hash:
106eb2f89d457f45df5bbe9232eaff15
SHA1 hash:
19b83ec8780cb9e27dd76323e819a1c3477a005f
Link:
https://www.unpac.me/results/1ecaa685-e140-4fef-a27a-47648bda240d/
SH256 hash:
fdccaed76f7279e6b8cc1579dadeed03fa1b8d1adcdfbcac585a68da168366d5
MD5 hash:
8b603b23caf00139206f293eb741a9f0
SHA1 hash:
1cc90aec7ce07b13930fe0c088fe3cd155b3ea07
Link:
https://www.unpac.me/results/1ecaa685-e140-4fef-a27a-47648bda240d/
SH256 hash:
255dd68b5ad0c44fb5d151dca60490d203a9bb79988aba90dd581941c98064fe
MD5 hash:
996d21f1086d74e25ffc50f6faa8bd22
SHA1 hash:
f89c299f2c0c4005e6f737bdb961cbfd193e1c5c
Link:
https://www.unpac.me/results/1ecaa685-e140-4fef-a27a-47648bda240d/
SH256 hash:
63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036
MD5 hash:
13db34cab435d9858269c5e823f4b575
SHA1 hash:
c6e9c301d3cfaf6671490c47c1ed4eb59f343f21
Link:
https://www.unpac.me/results/1ecaa685-e140-4fef-a27a-47648bda240d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:Telegram_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1103589/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/133102/

Comments