MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b4d7149128d7b9e07fb68168bc0d958411ec6b5892b00b3201d07393fcc579b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b4d7149128d7b9e07fb68168bc0d958411ec6b5892b00b3201d07393fcc579b
SHA3-384 hash: 277bd1fed238172133cbeafd071f9264f727f88d27633f41ced95d7f8b63a80e54f818e15ebd9b7d0bcb61d7ca6c3e9c
SHA1 hash: 267e5a5c124b301b774607c80c24b7d643e00001
MD5 hash: cbd41cdd6e5a7eaeec79030a631e2b13
humanhash: indigo-fix-eleven-eighteen
File name:cbd41cdd6e5a7eaeec79030a631e2b13
Download: download sample
File size:96'256 bytes
First seen:2022-03-02 19:31:57 UTC
Last seen:2022-03-02 22:39:49 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 1536:Z0nBIdUbrJum2hEEYbplVwiPzQrnMQzHfx7Tn7GIc:mbn2hVWp1z9Qz/92H
Threatray 1'468 similar samples on MalwareBazaar
TLSH T1EE93181AB7DA8B02C19C1D74C5D3552103FBE7CB3673EB5A3E5452960E023E98E89BC9
Reporter zbetcheckin
Tags:32 dll exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/246492/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.39114973.15826.10033.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/621fc63b0cd58dbd9264e194/reports/9cd730a1-e052-433a-a2b4-458cfa1f8dd2/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/a999123e-df8e-4364-9195-25bdab708f3a
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/949461
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b4d7149128d7b9e07fb68168bc0d958411ec6b5892b00b3201d07393fcc579b/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-03-02 14:31:00 UTC
File Type:
PE (.Net Dll)
Extracted files:
4
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
015413a27756d532fb91bd33bc910274232efcfe170cd93794dd1ebfbac72212
4df50c6d6d188c3413bdba53851cbeea7b281b92b0d5341c021a65912395fa5b
6339a14fb049a069fed24b0a9827ab82710426e174139d172a6536bfb1519402
757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad
85c1a06a65d0678a84384f7329e26721be1f89964dfb8b9b1f2812cdc70e169b
956bd054893f8940d72ec94175b2f063ac759a1f9cee3a0cad7eb3b7871bae2f
b17bfed7ccb65140f22de398cfcb56faa877dd36410bac51453f8ad9f1537bda
b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153
c787a0aa20d047aec48e31f551fe6511c893f93abd0210a5cfbd95b3b9cc5750
f6c873080547760ab6e3e7d4b59c74cbfb9151275e7aa6f888d251f4549c7e69
+ 1'458 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220302-x8yrvsgag5/
Unpacked files
SH256 hash:
6b4d7149128d7b9e07fb68168bc0d958411ec6b5892b00b3201d07393fcc579b
MD5 hash:
cbd41cdd6e5a7eaeec79030a631e2b13
SHA1 hash:
267e5a5c124b301b774607c80c24b7d643e00001
Link:
https://www.unpac.me/results/13875755-5df1-4d67-a007-4a3a523df7ab/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6b4d7149128d7b9e07fb68168bc0d958411ec6b5892b00b3201d07393fcc579b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DLL dll 6b4d7149128d7b9e07fb68168bc0d958411ec6b5892b00b3201d07393fcc579b

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2071307/
Cape
Cape
https://www.capesandbox.com/analysis/246492/

Comments


Avatar
zbet commented on 2022-03-02 19:31:58 UTC

url : hxxp://olypath.com/CommonDesignPatterns.dll