MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e4422d8d101bf53165220c1fce47839b23a41057420d070fb909979415553f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e4422d8d101bf53165220c1fce47839b23a41057420d070fb909979415553f8
SHA3-384 hash: cafabbd7f76dc23925d08c586f21a99c58509fe38681c5aa7379515cb0bf8a88b5bc91a5085ce4b3e91371ca19e5f353
SHA1 hash: 35e3b8bc572d9ceadb2d519c4013fcf3632da802
MD5 hash: ec3afdbd761916a682e9372834365939
humanhash: vermont-yankee-east-don
File name:SecuriteInfo.com.Trojan.DownLoaderNET.786.13278.22147
Download: download sample
File size:2'274'400 bytes
First seen:2024-09-16 19:18:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9e02808def02e999c496dcaa4fcfd6ba (2 x CryptBot, 1 x Smoke Loader, 1 x RedLineStealer)
ssdeep 49152:tI/0Xh92X3FAOkoQgcK11eVBOHpwIf0bOtW1sLjS5gd:WO2X33DVp98bObLwK
Threatray 99 similar samples on MalwareBazaar
TLSH T11EB5BF15D3E802A5E47BC630CA699733C7B1B85A2734D68B0659D6862FB3ED14B3F312
TrID 47.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
35.2% (.EXE) InstallShield setup (43053/19/16)
8.6% (.EXE) Win64 Executable (generic) (10523/12/4)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe signed

Code Signing Certificate

Organisation:Microsoft Code Signing PCA 2011
Issuer:Microsoft Code Signing PCA 2011
Algorithm:sha256WithRSAEncryption
Valid from:2024-08-19T09:12:56Z
Valid to:2025-08-19T09:12:56Z
Serial number: 968f27650beb8fea06105c962f8ed5ff
Thumbprint Algorithm:SHA256
Thumbprint: fa3c112ffc2a6252f825d426b4f66d7caa58828660abff304320d7c0b53c908a
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
370
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Channel2.exe
Verdict:
Suspicious activity
Analysis date:
2024-09-16 16:46:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/78aa83be-8ad8-4b01-a19c-3261e5f3ebaf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.DownLoaderNET.786.13278.22147.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66e884a82ebf76853bd5dacf
Tags:
Encryption Execution Network Static Stealth Generickd
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint hacktool lolbin microsoft_visual_cc overlay packed regedit remote
Link:
https://www.filescan.io/uploads/66e884af3c9389b729b8a586/reports/5990d5cb-caf3-44b1-9540-d07e7431bf1e/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/6e4422d8d101bf53165220c1fce47839b23a41057420d070fb909979415553f8
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/21b9d1ab-92a7-41d6-b208-0f1e5a319bbe
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1512141
Signature
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Connects to a pastebin service (likely for C&C)
Creates HTML files with .exe extension (expired dropper behavior)
Disables UAC (registry)
Drops script or batch files to the startup folder
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Silenttrinity Stager Msbuild Activity
Writes to foreign memory regions
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1512141 Sample: SecuriteInfo.com.Trojan.Dow... Startdate: 16/09/2024 Architecture: WINDOWS Score: 100 51 pastebin.com 2->51 53 yip.su 2->53 55 3 other IPs or domains 2->55 65 Antivirus detection for URL or domain 2->65 67 Antivirus / Scanner detection for submitted sample 2->67 69 Multi AV Scanner detection for submitted file 2->69 73 5 other signatures 2->73 8 SecuriteInfo.com.Trojan.DownLoaderNET.786.13278.22147.exe 2 2->8         started        11 svchost.exe 1 1 2->11         started        14 cmd.exe 2->14         started        16 22 other processes 2->16 signatures3 71 Connects to a pastebin service (likely for C&C) 51->71 process4 dnsIp5 81 Writes to foreign memory regions 8->81 83 Allocates memory in foreign processes 8->83 85 Adds a directory exclusion to Windows Defender 8->85 87 2 other signatures 8->87 18 MSBuild.exe 15 18 8->18         started        23 powershell.exe 23 8->23         started        25 conhost.exe 8->25         started        35 2 other processes 8->35 63 127.0.0.1 unknown unknown 11->63 27 conhost.exe 14->27         started        29 conhost.exe 16->29         started        31 conhost.exe 16->31         started        33 conhost.exe 16->33         started        37 19 other processes 16->37 signatures6 process7 dnsIp8 57 pastebin.com 104.20.4.235, 443, 49713, 49719 CLOUDFLARENETUS United States 18->57 59 iplogger.com 104.21.76.57, 443, 49732, 49739 CLOUDFLARENETUS United States 18->59 61 yip.su 188.114.97.3, 443, 49716, 49722 CLOUDFLARENETUS European Union 18->61 43 C:\Users\...\v6vceHiI5YDkGCej6J99jPOi.bat, ASCII 18->43 dropped 45 C:\Users\...\Q0yFl4HZQFpr4zRkESdCNqpF.bat, ASCII 18->45 dropped 47 C:\Users\...47QwtNbU54qs5kl5tTGMFFPkC.bat, ASCII 18->47 dropped 49 2 other malicious files 18->49 dropped 75 Drops script or batch files to the startup folder 18->75 77 Creates HTML files with .exe extension (expired dropper behavior) 18->77 79 Loading BitLocker PowerShell Module 23->79 39 conhost.exe 23->39         started        41 WmiPrvSE.exe 23->41         started        file9 signatures10 process11
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6e4422d8d101bf53165220c1fce47839b23a41057420d070fb909979415553f8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e4422d8d101bf53165220c1fce47839b23a41057420d070fb909979415553f8/
Threat name:
Win64.Downloader.Taily
Create hunting rule
Status:
Malicious
First seen:
2024-08-19 14:13:41 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
21 of 36 (58.33%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nzccfwgrag7vgfsseda7zzdyhgzduqifoqqna4h3scmxsqkvkp4a._file
Verdict:
malicious
Similar samples:
2dc71df189b524221912ee8aedf8dab43bea8080526c1260b2567a07455f0c46
45923c5e0fa75d8265252dcdaa59b90db697db59e1badc8e474ac804ddeb41fd
63d9319414c01f4172c4fdb53645cfd848f380bdc08ed3c1cb83bacb715b6770
6e4422d8d101bf53165220c1fce47839b23a41057420d070fb909979415553f8
871ff4f111c7042e1c73e77bc497b8442d51e617ceb546ddb00dc193e7ea9eb9
b51004463e8cdfe74c593f1d3e883ff20d53ad6081de7bf46bb3837b86975955
+ 89 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery evasion execution trojan
Link:
https://tria.ge/reports/240916-x1hexavgpn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Drops startup file
Command and Scripting Interpreter: PowerShell
UAC bypass
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3a27b0e7-b6b7-40b8-8a9e-0fe6e07967a5
Unpacked files
SH256 hash:
6e4422d8d101bf53165220c1fce47839b23a41057420d070fb909979415553f8
MD5 hash:
ec3afdbd761916a682e9372834365939
SHA1 hash:
35e3b8bc572d9ceadb2d519c4013fcf3632da802
Link:
https://www.unpac.me/results/42be8346-4b8c-40dc-af10-c843cae772f4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6e4422d8d101/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e4422d8d101bf53165220c1fce47839b23a41057420d070fb909979415553f8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:Detect_APT29_WINELOADER_Backdoor
Create hunting rule
Author:daniyyell
Description:Detects APT29's WINELOADER backdoor variant used in phishing campaigns, this rule also detect bad pdf,shtml,htm and vbs or maybe more depends
Reference:https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 6e4422d8d101bf53165220c1fce47839b23a41057420d070fb909979415553f8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3176990/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::CreateWellKnownSid
ADVAPI32.dll::RevertToSelf
ADVAPI32.dll::GetSecurityDescriptorLength
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetWindowsAccountDomainSid
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenThreadToken
ADVAPI32.dll::SetThreadToken
KERNEL32.dll::VirtualAllocExNuma
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetSystemInfo
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::FreeConsole
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleWindow
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_BCRYPT_APICan Encrypt Filesbcrypt.dll::BCryptDestroyKey
bcrypt.dll::BCryptGenerateSymmetricKey
bcrypt.dll::BCryptGenRandom
bcrypt.dll::BCryptOpenAlgorithmProvider
bcrypt.dll::BCryptCloseAlgorithmProvider
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyExW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryInfoKeyW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW

Comments