MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b2e51f4c3cadfd3441d843a96ebb56c50cb132ced3083bbf2f0ac760aca121c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6b2e51f4c3cadfd3441d843a96ebb56c50cb132ced3083bbf2f0ac760aca121c
SHA3-384 hash:	b097de18026cd5fb270e2920d6556a9814003c01d579ea54e133e43a113964da96e55e85d80479a3465a6801ef91c708
SHA1 hash:	f35be99d9b50bbddd3e8af3fa955e1be4401f894
MD5 hash:	9a929e07041c7f73f38addf39099738f
humanhash:	uncle-fifteen-failed-black
File name:	Planets Therapy Installer.exe
Download:	download sample
File size:	82'587'443 bytes
First seen:	2024-02-05 12:39:47 UTC
Last seen:	2024-02-05 14:28:40 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (527 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	1572864:3D6LBYYcLL+oX5YQxwhoZHBFdNYZvpXm6IKEp:36upnX5RxGozFC3IKE
TLSH	T1BB0833AA0A45311AF0E933FA3F3E6DEEF634C0012B5555F3AC955686CC83CE66C6846D
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.9% (.EXE) Win32 Executable (generic) (4504/4/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
dhash icon	c4dadadad2f492c2 (25 x GuLoader, 14 x RemcosRAT, 7 x AgentTesla)
Reporter	JaffaCakes118
Tags:	exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

330

Origin country :

RO

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/65c0d72e19fc3809142227e9/reports/2a25633a-4b66-47bd-8ae9-cff8baa10513/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/6b2e51f4c3cadfd3441d843a96ebb56c50cb132ced3083bbf2f0ac760aca121c

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox suspicious

Result

Threat name:

n/a

Detection:

suspicious

Classification:

n/a

Score:

32 / 100

Link:

https://www.joesandbox.com/analysis/1386762

Signature

Drops large PE files

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nmxfd5gdzlp5gra5qq5jn25vnrimwezm5uyiho7s6cwhmcwkcioa._file

Threatray unknown

Verdict:

unknown

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/240205-pv8e5saafm/

Behaviour

Checks processor information in registry

Enumerates processes with tasklist

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks installed software on the system

Looks up external IP address via web service

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.