MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 693f4ad5fff2c9a297b872a1d1d7dcb04e7b9c5fcd8eeff329b57932ab92096a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 693f4ad5fff2c9a297b872a1d1d7dcb04e7b9c5fcd8eeff329b57932ab92096a
SHA3-384 hash: 04f9d65248cac56e92e641cd4ebbebd3a1e41da94a9c7373589acb4e3eeff64d404969b914044f971a81ec4b3b7fe4c6
SHA1 hash: 5d77584dbaf4a8bb9553f54592d8f020f7ed18ae
MD5 hash: a8391484ece0b5eca2128738ff63d200
humanhash: pip-music-oven-mississippi
File name:Pedido_Faturar.HWXBU.msi
Download: download sample
File size:12'139'008 bytes
First seen:2023-04-20 09:46:08 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:+knYwWeMhHnN9k7LD2SNnWYLuNwZdB7ZkXqIAH+KLj1nDZN0V5vtsAaEU4aJCy63:+kYwWFN9eLzbLuNwRaweMnDb0Vc/BCy6
TLSH T114C62325A3C78636C55D013BE928FE1E0539BFA3473140E7BBE83D6E98F08C152B9656
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/383664/
Detection(s):
SecuriteInfo.com.Program.Unwanted.5405.22349.11000.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
shell32.dll
Link:
https://www.filescan.io/uploads/64410a175f1a7d8b4b01c1d1/reports/d9f3bf6c-2556-4057-921a-40c2d2bbac89/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/693f4ad5fff2c9a297b872a1d1d7dcb04e7b9c5fcd8eeff329b57932ab92096a
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/693f4ad5fff2c9a297b872a1d1d7dcb04e7b9c5fcd8eeff329b57932ab92096a
Result
Threat name:
n/a
Detection:
malicious
Classification:
rans.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1217829
Signature
Antivirus detection for dropped file
Found potential ransomware demand text
Hides threads from debuggers
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to evade debugger and weak emulator (self modifying code)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/693f4ad5fff2c9a297b872a1d1d7dcb04e7b9c5fcd8eeff329b57932ab92096a/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ne7uvvp76le2ff5yokq5dv64wbhhxhc7zwho74zjwv4tfk4sbfva._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/230420-lr7gwsba3y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/693f4ad5fff2c9a297b872a1d1d7dcb04e7b9c5fcd8eeff329b57932ab92096a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Raspberry_Robin_DLL_MAY_2022
Create hunting rule
Author:CD_R0M_
Description:Detects DLL dropped by Raspberry Robin.
Reference:https://redcanary.com/blog/raspberry-robin/
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR
Rule name:Windows_Trojan_Generic_a160ca52
Create hunting rule
Author:Elastic Security
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/383664/

Comments