MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6de025fe880bef1967fb742becd8884b9010ae7fb00c1c3a77d4dd8143e3ea67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6de025fe880bef1967fb742becd8884b9010ae7fb00c1c3a77d4dd8143e3ea67
SHA3-384 hash: 307ed582c6b4b7520060e8a3b0b7587b1d5600886c8c9ba8ef013aa75f8a99e0141316ad92105f5dfbb17621e962fb5c
SHA1 hash: 4f0c3571b52e3b87a85775e484a3f65b8c702981
MD5 hash: bc79e5809c9457102cb9dc5222b5e0be
humanhash: cat-don-snake-spring
File name:bc79e5809c9457102cb9dc5222b5e0be
Download: download sample
File size:13'619'432 bytes
First seen:2021-10-15 13:13:47 UTC
Last seen:2021-10-15 14:07:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 393216:WMk53Eo2vZ8lsSHpUrsPJetEXAGZAKpwsL/i:AJEUOgRetRK2sO
Threatray 19 similar samples on MalwareBazaar
TLSH T1D7D6332EF16FC40DF6865135CF3ED6A36D64BE52840204ADA804F9683D12B2F176F9AD
File icon (PE):PE icon
dhash icon c29caeaa99c18ad2
Reporter zbetcheckin
Tags:32 exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
294
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bc79e5809c9457102cb9dc5222b5e0be
Verdict:
No threats detected
Analysis date:
2021-10-15 13:25:54 UTC
Tags:
installer
Link:
https://app.any.run/tasks/7b225312-842c-43cc-9756-881b82088743

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Fsysna.8259.32023.2543.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
60%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/61697ee3db358dd15eb99fe1/reports/42ad2551-b52c-4fea-ad83-eefed018be15/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3afaf1b2-e47e-4223-abce-2078b5eb29bd
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/871156
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6de025fe880bef1967fb742becd8884b9010ae7fb00c1c3a77d4dd8143e3ea67/
Threat name:
Win32.Trojan.Startun
Create hunting rule
Status:
Malicious
First seen:
2021-10-09 21:23:41 UTC
AV detection:
8 of 28 (28.57%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0bcf14216198351151d34d3e6ea6c05bf06c62eee05e15804ba132ea455b3710
111d1529eb5320465bc09a12146b321b0f4409372a8b73048b7798904082068c
3c167530a131f9dc899b73b9eac971b38e44d41cf291893fde8e575602c2b846
418c5fa990720936d23f83e5bd72b11d4bbf045b33e60efe09e28aa074eac424
48643d9ccc694960fb84f505524d0f148a0331a7e2569171ff3999dd60bc7154
703d46e527cbce0c838146a5bb4d93593fb2942ae8dda6cd4d017c5de510549e
8040940621af7b77ecbb66d16ca8fc924900960d48665247aa3f77d4de560c9a
a4f95464eccef0c4da2d48481ef8b1006a6ed0918fb421db63c793e1001bbeda
b56c9109fdb9e8d8853fa536f3cdea9528a8a53493d3f3dc9f49243e30ed6be5
f0380fcead378582fadeeddf805919af44febcd9386eb60b609477e8cfe04dc8
+ 9 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/211015-qgpasabfgk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Enumerates physical storage devices
Loads dropped DLL
Unpacked files
SH256 hash:
8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
MD5 hash:
0dc0cc7a6d9db685bf05a7e5f3ea4781
SHA1 hash:
5d8b6268eeec9d8d904bc9d988a4b588b392213f
Link:
https://www.unpac.me/results/8d2920b4-42b5-43ae-b521-127cd7f4a90e/
SH256 hash:
a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
MD5 hash:
83cd62eab980e3d64c131799608c8371
SHA1 hash:
5b57a6842a154997e31fab573c5754b358f5dd1c
Link:
https://www.unpac.me/results/8d2920b4-42b5-43ae-b521-127cd7f4a90e/
SH256 hash:
6de025fe880bef1967fb742becd8884b9010ae7fb00c1c3a77d4dd8143e3ea67
MD5 hash:
bc79e5809c9457102cb9dc5222b5e0be
SHA1 hash:
4f0c3571b52e3b87a85775e484a3f65b8c702981
Link:
https://www.unpac.me/results/8d2920b4-42b5-43ae-b521-127cd7f4a90e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6de025fe880bef1967fb742becd8884b9010ae7fb00c1c3a77d4dd8143e3ea67

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 6de025fe880bef1967fb742becd8884b9010ae7fb00c1c3a77d4dd8143e3ea67

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1680970/

Comments


Avatar
zbet commented on 2021-10-15 13:13:48 UTC

url : hxxp://truelore-bj.s3.cn-north-1.jdcloud-oss.com/szqmfw/%E4%BA%91%E5%8D%97/%E6%95%B0%E5%AD%97%E7%AD%BE%E5%90%8D%E6%9C%8D%E5%8A%A1.exe