MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cadfb0b3edb3fd000c5df1c8853957efe2de172befc3132c96e4afeee2b0427. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cadfb0b3edb3fd000c5df1c8853957efe2de172befc3132c96e4afeee2b0427
SHA3-384 hash: 3dd74be63c44ac87dd6fa2f4bd1b916b012c7ff0f75503845346ef63f261670b55696e1bd6c97a59a7e1d1253d63210a
SHA1 hash: e9ebec33472c7c78900214c363aeb45027f0c8c4
MD5 hash: a2f39491c9d6e8be4a1bf05ac024fdb4
humanhash: eight-early-alabama-william
File name:SecuriteInfo.com.Trojan.Win32.Themida.18330.16972
Download: download sample
File size:10'196'712 bytes
First seen:2024-06-08 21:42:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 817659d4155ea1f078b4ced0ba1f20e9
ssdeep 196608:vOlhlJ0nBjr+3XR1qU1SoisXgLp7iy39KqQv43nKZ:GhfYJy3HSBsXgRfO43y
TLSH T1F8A62316F2D78132E1EF42315DA6EB358974BD333521852BBBE0234A5E73A82E536353
TrID 71.4% (.EXE) MS generic-sfx Cabinet File Unpacker (32/64bit MSCFU) (350567/2/26)
11.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
6.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
3.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
2.1% (.EXE) Win64 Executable (generic) (10523/12/4)
File icon (PE):PE icon
dhash icon 6ded69c7b130b2c0 (15 x ValleyRAT, 12 x CryptBot, 8 x NetSupport)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
445
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6cadfb0b3edb3fd000c5df1c8853957efe2de172befc3132c96e4afeee2b0427.exe
Verdict:
No threats detected
Analysis date:
2024-06-08 21:43:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e703a0fe-1b39-4a21-be9b-d4a8ac9694f4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Win32.Themida.18330.16972.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=666702b45c0e232c1ff01c9fwin7simulatehigh_evasion
Tags:
Encryption Execution Static Stealth Themida
Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for the window
Creating a file in the %AppData% subdirectories
Searching for synchronization primitives
Launching a process
Creating a file in the %temp% directory
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypto epmicrosoft_visual_cc evasive explorer fingerprint installer lolbin microsoft_visual_cc msiexec overlay packed packed remote shell32
Link:
https://www.filescan.io/uploads/6664d0696b8dba248b3e806b/reports/439cca30-ebd7-420c-ac89-3f70c1c055e7/overview
Verdict:
Suspicious
Link:
https://www.hybrid-analysis.com/sample/6cadfb0b3edb3fd000c5df1c8853957efe2de172befc3132c96e4afeee2b0427
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4f83a5fd-1b08-416c-9255-3e0692257e78
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
8 / 100
Link:
https://www.joesandbox.com/analysis/1454105
Behaviour
Behavior Graph:
n/a
Score:
6%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/6cadfb0b3edb3fd000c5df1c8853957efe2de172befc3132c96e4afeee2b0427
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6cadfb0b3edb3fd000c5df1c8853957efe2de172befc3132c96e4afeee2b0427/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2019-02-28 20:04:30 UTC
File Type:
PE (Exe)
Extracted files:
3391
AV detection:
5 of 38 (13.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nsw7wcz63m75aagf34oiqu4vp37c3ylsx36dcmwjnzfp53rlaqtq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/240608-1kw5xahe43/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Enumerates connected drives
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/26f2e6f1-d1d9-474e-aa3f-6df75df4a689
Unpacked files
SH256 hash:
3377e31d233ff41aea253e6221815820997763acdf40b005f8791400366cb8ff
MD5 hash:
33c9213ff5849ef7346799cae4d8ac80
SHA1 hash:
5421169811570171e9d2d0a1cdca9665273e7b59
Link:
https://www.unpac.me/results/96ea9d59-af5f-40ae-8bb4-06c4f92ce4e5/
SH256 hash:
69cd5b34cf3edf623b2a7df927f51c0f34669a410321375d4b682d6a14d1b5b0
MD5 hash:
47d953c6a11948f834ddf5ca8ce4c416
SHA1 hash:
c33d96c29caf386bc4a2211ee9edb5196eae15d2
Link:
https://www.unpac.me/results/96ea9d59-af5f-40ae-8bb4-06c4f92ce4e5/
SH256 hash:
537154e8cea49af3a28cfa1c345a24e5cc11baf91ccd7a048651d20686283ed0
MD5 hash:
30ae4055e81b4b238d0227b844577674
SHA1 hash:
c8f91b896c81682bb473a2db1c9b1dfa1e85d2ca
Link:
https://www.unpac.me/results/96ea9d59-af5f-40ae-8bb4-06c4f92ce4e5/
SH256 hash:
41f45a46ee56626ff2699d525bb56a3bb4718c5ca5f4fb5b3b38add64584026b
MD5 hash:
5689d43c3b201dd3810fa3bba4a6476a
SHA1 hash:
6939100e397cef26ec22e95e53fcd9fc979b7bc9
Link:
https://www.unpac.me/results/96ea9d59-af5f-40ae-8bb4-06c4f92ce4e5/
SH256 hash:
562949c7719b550ee90c03e1b04c45693afed5eca4604a5f0ac75d5c35df4ee9
MD5 hash:
54160f89578d7f330623d1b94fe9d7c6
SHA1 hash:
6199dbe112f47426eb374cc0293ab03c7e092e28
Link:
https://www.unpac.me/results/96ea9d59-af5f-40ae-8bb4-06c4f92ce4e5/
SH256 hash:
6cadfb0b3edb3fd000c5df1c8853957efe2de172befc3132c96e4afeee2b0427
MD5 hash:
a2f39491c9d6e8be4a1bf05ac024fdb4
SHA1 hash:
e9ebec33472c7c78900214c363aeb45027f0c8c4
Link:
https://www.unpac.me/results/96ea9d59-af5f-40ae-8bb4-06c4f92ce4e5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6cadfb0b3edb3fd000c5df1c8853957efe2de172befc3132c96e4afeee2b0427

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Havex
Create hunting rule
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 6cadfb0b3edb3fd000c5df1c8853957efe2de172befc3132c96e4afeee2b0427

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2879955/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
SHELL32.dll::ShellExecuteExW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
KERNEL32.dll::CreateProcessA
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetStartupInfoA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::WriteConsoleA
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileW
KERNEL32.dll::DeleteFileA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::EmptyClipboard
USER32.dll::FindWindowW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments