MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 674f31aed8544f2f54423de908559f3d1964ef4f3391d2bf989915766b8c42e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GrandaMisha


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 674f31aed8544f2f54423de908559f3d1964ef4f3391d2bf989915766b8c42e9
SHA3-384 hash: ea143fdc28ae037273db74609271def7124c55c614ff2682e6eaf721c3dfb28cb22f968e5246266ea5babc75905c09ee
SHA1 hash: 6d98d3684fc38a448926bc7eaec38b0db20f2776
MD5 hash: 6054129893e238730e31460e6924ce3b
humanhash: hawaii-eleven-batman-cup
File name:6054129893e238730e31460e6924ce3b.exe
Download: download sample
Signature GrandaMisha
Create hunting rule
File size:2'102'272 bytes
First seen:2022-01-24 06:58:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2ea46fd288209af535efaef075889460 (2 x RedLineStealer, 1 x GrandaMisha, 1 x Smoke Loader)
ssdeep 49152:0qbduUb481ECZXVZZagT+XG+vNRCVvNTAtwlAgZ+avT:XZap2eRCVvpIM+q
Threatray 6 similar samples on MalwareBazaar
TLSH T146A533B0B640D075E5222E306DBA8FE6A53E6CB10228858BBBDE179DCF553D1335A14F
File icon (PE):PE icon
dhash icon fcfcb4b4b494d9c1 (74 x Amadey, 56 x Smoke Loader, 38 x RedLineStealer)
Reporter abuse_ch
Tags:exe GrandaMisha

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/221825/
Detection(s):
Win.Malware.Mikey-9917879-0
Create hunting rule

Win.Packed.Lockbit-9919158-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
DNS request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Sending a custom TCP request
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61ee4e390f8c757253e0ee22/reports/71f17fcb-168d-40b2-b39e-1b28a1eda7d3/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/76f41ef0-65b1-49c1-b12f-57fd3d2acf17
Result
Threat name:
Unknown
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/926077
Signature
Antivirus detection for URL or domain
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/674f31aed8544f2f54423de908559f3d1964ef4f3391d2bf989915766b8c42e9/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-01-24 06:59:38 UTC
File Type:
PE (Exe)
Extracted files:
29
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1ae99a454f6c11e30c346ca825e2d20bc5450ddb808f25dd20a4d952604d34f0
GrandaMisha
4f10f503422560da8a332c30323401af59a914af940716d06e139ed7371be53f
GrandaMisha
5e1626ac3140548619efba38a154b98234080908158378ad2e7e4af9e92cfbb8
GrandaMisha
8441c5d0d5ee30f94f54459ba89a3a2d20677d98313c120f32bf98015214049f
GrandaMisha
b44db0bf0992d55c7353fe368322fe0b1e912b2a381c4bf8b7c56c9fcd2a86ff
GrandaMisha
c449bd8ac54c8c55b239bc43363edd87e9308c43d29d6cd9d55f6693da1e8170
GrandaMisha
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection spyware stealer
Link:
https://tria.ge/reports/220124-hr3xxsdfck/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
9af802039a2d10a04472824411e07e2a5e41754ca9aaf087f461b1c36ce16195
MD5 hash:
b55156d602592488a125098d42e2dbb3
SHA1 hash:
b919d10c37e48e9274fae07a4e07289e96d88c6d
Link:
https://www.unpac.me/results/0459c6f1-7a3a-48ec-9d1d-2e4ca53fb748/
SH256 hash:
674f31aed8544f2f54423de908559f3d1964ef4f3391d2bf989915766b8c42e9
MD5 hash:
6054129893e238730e31460e6924ce3b
SHA1 hash:
6d98d3684fc38a448926bc7eaec38b0db20f2776
Link:
https://www.unpac.me/results/0459c6f1-7a3a-48ec-9d1d-2e4ca53fb748/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/674f31aed854/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/674f31aed8544f2f54423de908559f3d1964ef4f3391d2bf989915766b8c42e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GrandaMisha

Executable exe 674f31aed8544f2f54423de908559f3d1964ef4f3391d2bf989915766b8c42e9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2000447/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/221825/

Comments