MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e059d359fcd623cce0d823966aa04458ab5581d65bdf9d85f077c7ed52dff9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e059d359fcd623cce0d823966aa04458ab5581d65bdf9d85f077c7ed52dff9f
SHA3-384 hash: bff39e4ae35dadeb8dd52e31119ce9153baec032b816bd3fba732151221de07cd68bea79d053439e8ae675f2024265ff
SHA1 hash: 5a91c7c60167e4dbded946e3b768b320e033528d
MD5 hash: 4a1f2dc9c8df4981eb8f8003afdf21f9
humanhash: south-william-march-seven
File name:4a1f2dc9c8df4981eb8f8003afdf21f9
Download: download sample
File size:1'120'520 bytes
First seen:2023-04-28 11:58:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:G2Bf9f3u+9UjIS1Nl1JPSAqn4HuuwOBJM12nYELdGCLEa:G27f3kFaA6intWa
Threatray 426 similar samples on MalwareBazaar
TLSH T15435230329D81F61C714C93E31ADC61D1673CBA24DDAACEF727564CE87B96A30D42D26
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter zbetcheckin
Tags:32 exe signed

Code Signing Certificate

Organisation:O PLUS K LTD
Issuer:Sectigo Public Code Signing CA R36
Algorithm:sha384WithRSAEncryption
Valid from:2023-04-20T00:00:00Z
Valid to:2024-04-19T23:59:59Z
Serial number: 6615b213598e4374aa52de4e5debd105
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: c606af5c9753112311097876d6960cc9bd99ad6756fe85c39125c0a6a5c04f96
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
280
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4a1f2dc9c8df4981eb8f8003afdf21f9
Verdict:
Malicious activity
Analysis date:
2023-04-28 12:01:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/162153a5-6ef9-4e00-a3f1-b443d59bc657

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/385456/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Creating a process from a recently created file
Creating a file in the %temp% directory
Enabling the 'hidden' option for recently created files
Сreating synchronization primitives
Launching a process
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a file
DNS request
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed packed
Link:
https://www.filescan.io/uploads/644bb506eabaad23dca12c9d/reports/6cd61bae-c054-4db3-99cd-6b7a9af6b86b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/6e059d359fcd623cce0d823966aa04458ab5581d65bdf9d85f077c7ed52dff9f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/db01b972-93cc-47b2-949c-47d61d862918
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
45 / 100
Link:
https://www.joesandbox.com/analysis/1222785
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Renames powershell.exe to bypass HIPS
Very long command line found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 855737 Sample: SEQ833Ufdl.exe Startdate: 28/04/2023 Architecture: WINDOWS Score: 45 49 Multi AV Scanner detection for submitted file 2->49 51 Machine Learning detection for sample 2->51 8 SEQ833Ufdl.exe 1 2 2->8         started        10 SEQ833Ufdl.exe 2->10         started        12 SEQ833Ufdl.exe 2->12         started        process3 process4 14 cmd.exe 1 8->14         started        17 cmd.exe 8->17         started        19 cmd.exe 8->19         started        signatures5 57 Very long command line found 14->57 21 cmd.exe 1 14->21         started        24 conhost.exe 14->24         started        26 cmd.exe 2 17->26         started        29 conhost.exe 17->29         started        31 cmd.exe 19->31         started        33 conhost.exe 19->33         started        process6 file7 35 unsdk.bat.exe 15 21->35         started        37 conhost.exe 21->37         started        47 C:\Users\user\AppData\...\unsdk.bat.exe, PE32+ 26->47 dropped 53 Very long command line found 26->53 55 Renames powershell.exe to bypass HIPS 26->55 39 unsdk.bat.exe 15 26->39         started        41 conhost.exe 26->41         started        43 unsdk.bat.exe 7 31->43         started        45 conhost.exe 31->45         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e059d359fcd623cce0d823966aa04458ab5581d65bdf9d85f077c7ed52dff9f/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-04-28 11:55:41 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nycz2nm7zvrdztqnqi4wnkqeiwflkwa5mw67twc7a56h5vjn76pq._file
Verdict:
malicious
Similar samples:
18ab5e7a8a16ee97cfaf8d710e023a7816f0e0c6e57c1d6ca2f9ca311db0dd12
2e085282467ab80f8064d2557f4afea9a82ba68e52ccd6f6f4c75e0f81dd0b30
91a2c70fd1c8105343b14cbfc161f3710c83afc002864c5e761f83ae51238d07
97698987bb3fb24a528404c1cef2e906739ce45145b79c4e088dd446ecaabccc
a1a664da8caa18e946e0f75b9153a6740e63f1c71d00ff6c7c43b5e8a2e50c6e
c0bd5fcd7a91eb868dddb6172f5e576b5efa1a4c57a7f5cade8f4cef236fb001
efb5f3b0881e717089934912881bcdb63874e66a00ba2250a845827e2ac40ff7
f3e6d297f48b8b6405ba1ca91b427044ccea48a2b3de50566eed45b25052f0cb
ffc01c801da56007ad2091bf088c9e8ce5fd807e0f7ff25f3c072265c07a2b73
+ 416 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/230428-n5qgmsdg48/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
6e059d359fcd623cce0d823966aa04458ab5581d65bdf9d85f077c7ed52dff9f
MD5 hash:
4a1f2dc9c8df4981eb8f8003afdf21f9
SHA1 hash:
5a91c7c60167e4dbded946e3b768b320e033528d
Link:
https://www.unpac.me/results/94bac1fe-f8ad-42f2-bbed-9d8b948cd820/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e059d359fcd623cce0d823966aa04458ab5581d65bdf9d85f077c7ed52dff9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 6e059d359fcd623cce0d823966aa04458ab5581d65bdf9d85f077c7ed52dff9f

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2619912/
Cape
Cape
https://www.capesandbox.com/analysis/385456/

Comments


Avatar
zbet commented on 2023-04-28 11:58:12 UTC

url : hxxp://185.74.222.228/NVDIA40.exe