MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c01253169adfbb36a7b2bcd1e284eee9a473a90e823c280927a2628fbaeba74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c01253169adfbb36a7b2bcd1e284eee9a473a90e823c280927a2628fbaeba74
SHA3-384 hash: b822bd6e2c0427da2576a352d9139043bcd9b43a846254f2a5b4c449fe282a5047732b4631c1544d1f038f983f7e0bd4
SHA1 hash: 15a15ac3dc29b7ebb8637dfb527170c6583bb4d6
MD5 hash: 0d1512a98b568bb811512314061381e8
humanhash: william-idaho-zebra-louisiana
File name:0d1512a98b568bb811512314061381e8.exe
Download: download sample
File size:363'008 bytes
First seen:2022-09-11 20:56:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a490e3ca20f57194cb1f4b473b3242c4 (17 x RedLineStealer, 1 x ArkeiStealer)
ssdeep 6144:n7ABjz0dqjbeIGm3Q3eiJr9LkrPYBmkE9c4Ypy5c9L:nKsEbeIGD19LkrPmmkE1Ypy5U
TLSH T16074CF62B1F4CD43F08B35F49CA11A4B4861872D8966C00D8B9D8D4CFAD6E7AFC991B7
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
388
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0d1512a98b568bb811512314061381e8.exe
Verdict:
Suspicious activity
Analysis date:
2022-09-11 20:59:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4a07131f-a9b2-4975-afa2-1b54c664b7ef

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/309367/
Detection(s):
SecuriteInfo.com.Variant.Tedy.200463.19442.9156.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Creating a file in the Windows subdirectories
Running batch commands
Searching for the window
Creating a process from a recently created file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm packed
Link:
https://www.filescan.io/uploads/631e4bb3a90642bcbb02cb11/reports/5d60f1a6-49d6-4eb6-8977-14ddd1698797/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/cc37d1aa-87c0-433a-8169-9c6b1c799c97
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1068539
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus / Scanner detection for submitted sample
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 701071 Sample: FveF8nauvN.exe Startdate: 11/09/2022 Architecture: WINDOWS Score: 80 45 Antivirus / Scanner detection for submitted sample 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 .NET source code contains method to dynamically call methods (often used by packers) 2->49 51 Machine Learning detection for sample 2->51 9 FveF8nauvN.exe 1 2->9         started        13 Clipper.exe 1 2->13         started        15 Clipper.exe 1 2->15         started        process3 file4 39 C:\Users\user\AppData\...\FveF8nauvN.exe.log, ASCII 9->39 dropped 53 Contains functionality to inject code into remote processes 9->53 55 Injects a PE file into a foreign processes 9->55 17 FveF8nauvN.exe 15 4 9->17         started        57 Multi AV Scanner detection for dropped file 13->57 21 conhost.exe 13->21         started        23 conhost.exe 15->23         started        signatures5 process6 dnsIp7 43 cdn.discordapp.com 162.159.130.233, 443, 49726 CLOUDFLARENETUS United States 17->43 37 C:\Windows\Temp\xsv.exe, PE32+ 17->37 dropped 25 cmd.exe 1 17->25         started        27 conhost.exe 17->27         started        file8 process9 process10 29 xsv.exe 1 7 25->29         started        33 conhost.exe 25->33         started        file11 41 C:\Users\user\AppData\Roaming\...\Clipper.exe, PE32+ 29->41 dropped 59 Multi AV Scanner detection for dropped file 29->59 35 conhost.exe 29->35         started        signatures12 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c01253169adfbb36a7b2bcd1e284eee9a473a90e823c280927a2628fbaeba74/
Threat name:
Win32.Trojan.Tedy
Create hunting rule
Status:
Malicious
First seen:
2022-09-11 09:18:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
21 of 41 (51.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nqaskmljvx53g2t3fpgr4kco52neoouq5ar4faespitcr65oxj2a._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/220911-zrj89afher/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Downloads MZ/PE file
Executes dropped EXE
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7219dd43-4820-4774-b9c1-0e0109600bfc
Unpacked files
SH256 hash:
11bb034636e1277c40ee6272b5d8478bc42fd0443a4987686461052c68b11c81
MD5 hash:
17fdf18364437fc0166c69da2059a830
SHA1 hash:
01ca006fb1b0c77cca2b3308b60b7d87dc127f3c
Link:
https://www.unpac.me/results/30998783-f9f4-4b3c-b5e0-5f2e2de9f05f/
SH256 hash:
6c01253169adfbb36a7b2bcd1e284eee9a473a90e823c280927a2628fbaeba74
MD5 hash:
0d1512a98b568bb811512314061381e8
SHA1 hash:
15a15ac3dc29b7ebb8637dfb527170c6583bb4d6
Link:
https://www.unpac.me/results/30998783-f9f4-4b3c-b5e0-5f2e2de9f05f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6c01253169adfbb36a7b2bcd1e284eee9a473a90e823c280927a2628fbaeba74

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 6c01253169adfbb36a7b2bcd1e284eee9a473a90e823c280927a2628fbaeba74

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2299863/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/309367/

Comments