MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e80e785c5b541432d1d48df09f152fdb8b68231fe4994486363bb9bf7399297. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e80e785c5b541432d1d48df09f152fdb8b68231fe4994486363bb9bf7399297
SHA3-384 hash: 3a738554d3915ad06a49dac1f1d73ed2947ade460ebedb153d36d902f504d659bf124150e1744be0029c83e00361ae8c
SHA1 hash: ceca8346497d40150baa748fed355b32f6687177
MD5 hash: 1ea47040d84ba4859ac8b74b9b093704
humanhash: zebra-virginia-summer-venus
File name:FACT-NATURGY-A4-SIMPLEX-A9-TLLTK_NOPAGO20112023249525941229219492494924.msi
Download: download sample
File size:7'857'152 bytes
First seen:2023-11-26 16:46:13 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:bLgXyb48cJTaImS2diE7i8DAc39yOTHo6:bLO5JThE7PsWH
Threatray 11 similar samples on MalwareBazaar
TLSH T1B5867C17B384653EC15A0B3A4877B658A83FBE713A128D5B77F4188D4F359803E3A64B
TrID 73.9% (.MSI) Microsoft Windows Installer (454500/1/170)
9.9% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.5% (.MSWMM) Windows Movie Maker project (46500/1/9)
7.2% (.MSP) Windows Installer Patch (44509/10/5)
1.3% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/460325/
Detection(s):
SecuriteInfo.com.Win32.SpywareX-gen.9930.6545.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Win32.SpywareX-gen.24906.23118.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control grandoreiro grandoreiro hook lolbin phishing remote replace
Link:
https://www.filescan.io/uploads/656376877485e5b1ecbbc308/reports/519a2172-d64b-4141-8a97-094cb38a7b3f/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/6e80e785c5b541432d1d48df09f152fdb8b68231fe4994486363bb9bf7399297
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/6e80e785c5b541432d1d48df09f152fdb8b68231fe4994486363bb9bf7399297
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1348007
Signature
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
96%
Verdict:
Malware
File Type:
MSI
Link:
https://malprob.io/report/6e80e785c5b541432d1d48df09f152fdb8b68231fe4994486363bb9bf7399297
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e80e785c5b541432d1d48df09f152fdb8b68231fe4994486363bb9bf7399297/
Threat name:
Win32.Spyware.Grandoreiro
Create hunting rule
Status:
Malicious
First seen:
2023-11-16 06:14:10 UTC
File Type:
Binary (Archive)
Extracted files:
196
AV detection:
18 of 23 (78.26%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2aopbofwvaugli5jdpqt4ks7w4lnarr7zezisddmo5zx5zzsklq._file
Verdict:
malicious
Similar samples:
240ab96d6d68f607108985a4057583ff271fc3a33b339f60e65807742f998121
35df13da60ec391a9b0ae34884f066ed8fa48c90315b37ee271a092025e527c0
6e80e785c5b541432d1d48df09f152fdb8b68231fe4994486363bb9bf7399297
706fbfd759241d1c28a263710be57d297ae3ec0ba217c6fa5ddbfefeb6d7e1ff
84eab515e95a0eb2eb1ab29c7213960983c103f8179d7e3125ea5cab29dfa59c
ded347e71ccba17c16b22e9fa9f9e273444028fd10383608802afbd26634a33b
f0134ff405cf5b97b4064a855059dcdeea4d0f31b5c35d4df0ccc54fdcc7f2fa
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231126-vahxmsae7z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Enumerates connected drives
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/6e80e785c5b541432d1d48df09f152fdb8b68231fe4994486363bb9bf7399297

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_LATAM_MSI_Banker
Create hunting rule
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/460325/

Comments