MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6bc6b15b89387d9de01d506ca19989f12e22ccdb8013ed94cfe2be54cf60c4f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	6bc6b15b89387d9de01d506ca19989f12e22ccdb8013ed94cfe2be54cf60c4f7
SHA3-384 hash:	34fabad761c045fe2b94c96d060857d453e5467a15a98e67834934ac5852edc8fd5ff53b8817b4f8555ce4d7b642a734
SHA1 hash:	e551494be489d3c3f22eac5025627e849021e483
MD5 hash:	0743ef7863b98b1b5176805448f86417
humanhash:	black-maine-washington-hawaii
File name:	file
Download:	download sample
File size:	283'136 bytes
First seen:	2023-10-11 17:00:03 UTC
Last seen:	2023-10-13 18:50:38 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4cea7ae85c87ddc7295d39ff9cda31d1 (85 x RedLineStealer, 68 x LummaStealer, 61 x Rhadamanthys)
ssdeep	6144:fahOwhA2YG8QG8RyjhdmerhCoUcieirM3I2ljGBW+VU03tiLI:fiJhlYH8RyrYFfFI3IejGg+VU03kL
Threatray	1'352 similar samples on MalwareBazaar
TLSH	T11954F10EA7D524F7E47883B880D34053D27178A21BA6A2FF01C4E5B99E13AD136B5F47
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10523/12/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	00b2b0b2b2b0b200 (1 x LummaStealer)
Reporter	andretavare5
Tags:	exe

andretavare5

Sample downloaded from http://171.22.28.212/carryspend.exe

Intelligence

File Origin

# of uploads :

182

# of downloads :

295

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2023-10-11 17:01:50 UTC

Tags:

payload opendir lumma stealer sinkhole

Link:

https://app.any.run/tasks/baebb8dd-14d3-47b6-a902-4d18aabca5c7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/453324/

Detection(s):

SecuriteInfo.com.FileRepMalware.13410.29170.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Сreating synchronization primitives

Sending a custom TCP request

Creating a file

DNS request

Sending an HTTP POST request

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Sending an HTTP GET request to an infection source

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

advpack CAB control explorer installer installer lolbin packed rundll32 setupapi shell32

Link:

https://www.filescan.io/uploads/6526d498a31588d184f77034/reports/b93a1631-691a-46ff-815b-c774c056d505/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/6bc6b15b89387d9de01d506ca19989f12e22ccdb8013ed94cfe2be54cf60c4f7

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d417ac00-eaec-4d84-9bfa-ce5da45d7df4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6bc6b15b89387d9de01d506ca19989f12e22ccdb8013ed94cfe2be54cf60c4f7/

Threat name:

Win64.Ransomware.Generic

Status:

Suspicious

First seen:

2023-10-11 17:01:05 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

7 of 38 (18.42%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=npdlcw4jhb6z3ya5kbwkdgmj6excftg3qaj63fgp4k7fjt3ayt3q._file

Verdict:

malicious

257891b32e5b952cf172a11affd291e4964ec9c1b24e51e174a4146503f8164a

75d7d46ed7d193c249f6f1d7e309b6986f1303e772599d90d65467b4a7d5f80a

8e97f86958e8abcbac1caa515bd07b0c20edc5c48b719e3d2a4f9ac14912165f

92f94ba0c124a7a8158ce117d838c026035116e2ab2565ebc437575ddf87eeea

9554e7ef83f9c1aabed52be7a308d7e25c99e7d71e006146aee045d29784f92d

b0b649dec72a9272fed5d4b7bae97ee80ea37044aea6e2fbcf94923b54c792d9

b37f7be1a4d8373425660e726dbeb8ab32be2b94ea36ae2481db6f1c144e9735

bec28def672957143374413ca61cc8bc072551e0547d9597de026f2592b562fc

f7b3f82ede7c4912eea7acea9aa344ee28b10cebe5b7a45a690651e9e40a8a4d

+ 1'342 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery persistence spyware stealer

Link:

https://tria.ge/reports/231011-vhy9lacf93/

Behaviour

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

6bc6b15b89387d9de01d506ca19989f12e22ccdb8013ed94cfe2be54cf60c4f7

MD5 hash:

0743ef7863b98b1b5176805448f86417

SHA1 hash:

e551494be489d3c3f22eac5025627e849021e483

Link:

https://www.unpac.me/results/417f1a27-e85f-415a-9153-5f0e1882269e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6bc6b15b89387d9de01d506ca19989f12e22ccdb8013ed94cfe2be54cf60c4f7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.