MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66cebd1b0a87df2ddcd805723d15e8094c23dfe1d4a2108348579995a102c994. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Pitou

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments 1

SHA256 hash:	66cebd1b0a87df2ddcd805723d15e8094c23dfe1d4a2108348579995a102c994
SHA3-384 hash:	d5eeef3517811d7222e76e06127184b9502d2efb7ed36b520f9fa442ae58a5fdd422a5f652064b65b9358445d2cf05d6
SHA1 hash:	f35896ae3509d26794ea207c93a5ae2725ac1c53
MD5 hash:	99a8becf9560cb3584930f0cdea99ecb
humanhash:	kilo-robert-purple-victor
File name:	99a8becf9560cb3584930f0cdea99ecb
Download:	download sample
Signature	Pitou Create hunting rule
File size:	698'880 bytes
First seen:	2021-08-10 11:01:42 UTC
Last seen:	2021-08-10 11:43:14 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	cc4caabe2c1a9c923331965c9764375d (3 x Pitou, 2 x RedLineStealer, 2 x GCleaner)
ssdeep	12288:5btUdicYVsqb/c7dJQx5BZtbZcUQ7URtFF3yZfBgAXaqxST:LolYVj59bZcRgtj3yZ5gAKqET
Threatray	13 similar samples on MalwareBazaar
TLSH	T1C9E4E130B660C034F9B711F845B6C3BDA92D7B729B3450CB92E41AEA57386E8AD31747
dhash icon	60e8e8e8aa66a499 (24 x RaccoonStealer, 14 x RedLineStealer, 7 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe Pitou

Intelligence

File Origin

# of uploads :

# of downloads :

892

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

99a8becf9560cb3584930f0cdea99ecb

Verdict:

Malicious activity

Analysis date:

2021-08-10 11:05:09 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/d9bbbae5-c047-4b16-a0c8-937d5ac7c214

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/177899/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.2607.18811.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Blocking the Windows Defender launch

Rewriting of the hard drive's master boot record

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Pitou

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f1c25cb1-6307-48e5-85b6-d31b3995d0b0

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/830080

Signature

Contains functionality to infect the boot sector

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/66cebd1b0a87df2ddcd805723d15e8094c23dfe1d4a2108348579995a102c994/

Threat name:

Win32.Trojan.Injuke

Status:

Malicious

First seen:

2021-08-10 11:02:05 UTC

AV detection:

15 of 28 (53.57%)

Threat level:

5/5

Result

Malware family:

n/a

Score:

6/10

Tags:

bootkit persistence

Link:

https://tria.ge/reports/210810-jv6w5x7fea/

Behaviour

Suspicious use of AdjustPrivilegeToken

Writes to the Master Boot Record (MBR)

Unpacked files

SH256 hash:

40952c341d05273c0c581ee26718e131666f4def5ae9839c686ba5e6bd57ba7d

MD5 hash:

7a37018d3bb55b535803345f8dfc14db

SHA1 hash:

008e8644fec789c07acea71ebd5a31742a3fa42c

Detections:

win_pitou_auto

Link:

https://www.unpac.me/results/6e7e2db7-b347-4796-8bed-3a3c4e1e0add/

Parent samples :

829f2d1a30848cec9b28b47782537ad64a3770d6b22359c0d3f5257215b49105
ce1c2e089ab14ef543b6604bd4fd82213708b89372fd63d414ff6e694ddce4ad
66cebd1b0a87df2ddcd805723d15e8094c23dfe1d4a2108348579995a102c994
7432d519a0a8042c26d8fa9637c9c07de4c33cde886feb1fbc063f1a5d828ed4
dd1dc97c210d7ed5cfe8c72bd8dd28bb080dcf1444d9770fdd7c5c436de345e5
b6b28602888cb4f4335d3e02a0a91cd945a64f1c5cd6372cf70aad05dc5c0d30
440de5c3ce1c9cf276516354babcae98f726b2f6a16d747f5ca2154b0e450410
d7eecb951a6b4439f8b71fc6b6d71b1892ee0c3ca26ae2e3fda22960515d8963
4004d8d0d2163211efed5e32a184c3842f643f02b29c5b619bb4ef97a8afc3e6

SH256 hash:

66cebd1b0a87df2ddcd805723d15e8094c23dfe1d4a2108348579995a102c994

MD5 hash:

99a8becf9560cb3584930f0cdea99ecb

SHA1 hash:

f35896ae3509d26794ea207c93a5ae2725ac1c53

Link:

https://www.unpac.me/results/6e7e2db7-b347-4796-8bed-3a3c4e1e0add/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/66cebd1b0a87/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/66cebd1b0a87df2ddcd805723d15e8094c23dfe1d4a2108348579995a102c994

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Pitou

exe 66cebd1b0a87df2ddcd805723d15e8094c23dfe1d4a2108348579995a102c994

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1521622/

Cape

https://www.capesandbox.com/analysis/177899/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-08-10 11:01:44 UTC

url : hxxp://37.120.239.108/200.exe