MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 703d46e527cbce0c838146a5bb4d93593fb2942ae8dda6cd4d017c5de510549e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.Eorezo


Vendor detections: 5


Intelligence 5 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 703d46e527cbce0c838146a5bb4d93593fb2942ae8dda6cd4d017c5de510549e
SHA3-384 hash: b962aa6716bc0ae9f2530a09f8eef7b91c154f03e808c9b40f4ab65e818d1bb88cfb294fdc51ee05e19ffffaea9358d5
SHA1 hash: 3e93b8236c7a6e82f50448b03f68d8ba662508f3
MD5 hash: 88f216ee25f70ed0704d8cc796ecd277
humanhash: saturn-texas-july-gee
File name:88F216EE25F70ED0704D8CC796ECD277.exe
Download: download sample
Signature Adware.Eorezo
Create hunting rule
File size:76'469 bytes
First seen:2021-03-22 17:39:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 1536:KpgpHzb9dZVX9fHMvG0D3XJJ4Romu/d7Sa4W+IGlf2mBi3nw:IgXdZt9P6D3XJJ459T97Ohnw
TLSH 7D73D007B6C0C9B3D6A70732097BD7BEE7B7CA98424067531B957F7F2D22163881A294
Reporter abuse_ch
Tags:Adware.Eorezo exe


Avatar
abuse_ch
Adware.Eorezo C2:
http://juhjuh.com/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://juhjuh.com/ https://threatfox.abuse.ch/ioc/4395/

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/126075/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
phis.evad
Score:
42 / 100
Link:
https://www.joesandbox.com/analysis/649142
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Creates files in the system32 config directory
Modifies Internet Explorer zone settings
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses netsh to modify the Windows network and firewall settings
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 373533 Sample: x1hr3jAjyo.exe Startdate: 23/03/2021 Architecture: WINDOWS Score: 42 81 wsgeoip.lavasoft.com 2->81 83 rt.webcompanion.com 2->83 85 flow.lavasoft.com 2->85 109 Multi AV Scanner detection for domain / URL 2->109 111 Multi AV Scanner detection for submitted file 2->111 10 x1hr3jAjyo.exe 39 2->10         started        14 svchost.exe 2->14         started        17 Lavasoft.WCAssistant.WinService.exe 2->17         started        19 11 other processes 2->19 signatures3 process4 dnsIp5 93 www.ickyud.pw 109.232.226.206, 49709, 80 GLOBALLAYERNL Netherlands 10->93 95 webcompanion.com 104.17.177.102, 49712, 49725, 49729 CLOUDFLARENETUS United States 10->95 101 3 other IPs or domains 10->101 65 C:\Users\user\AppData\Local\...\setup_2.exe, PE32 10->65 dropped 67 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 10->67 dropped 69 C:\Users\user\AppData\Local\...\inetc.dll, PE32 10->69 dropped 71 2 other files (none is malicious) 10->71 dropped 21 setup_2.exe 36 10->21         started        115 Changes security center settings (notifications, updates, antivirus, firewall) 14->115 24 MpCmdRun.exe 14->24         started        117 Creates files in the system32 config directory 17->117 26 cmd.exe 17->26         started        97 127.0.0.1 unknown unknown 19->97 99 rt.webcompanion.com 19->99 file6 signatures7 process8 file9 57 C:\Users\user\...\WebCompanionInstaller.exe, PE32 21->57 dropped 59 C:\Users\...\WebCompanionInstaller.exe.config, XML 21->59 dropped 61 C:\...\WebCompanionInstaller.resources.dll, PE32 21->61 dropped 63 11 other files (none is malicious) 21->63 dropped 28 WebCompanionInstaller.exe 33 113 21->28         started        33 conhost.exe 24->33         started        35 conhost.exe 26->35         started        process10 dnsIp11 103 wc-update-service.lavasoft.com 64.18.87.81, 49720, 49728, 49733 MTOCA Canada 28->103 105 flow.lavasoft.com 104.18.87.101, 443, 49716, 49721 CLOUDFLARENETUS United States 28->105 107 wcdownloadercdn.lavasoft.com 28->107 73 C:\...\Lavasoft.WCAssistant.WinService.exe, PE32 28->73 dropped 75 Lavasoft.WCAssista...nService.exe.config, XML 28->75 dropped 77 C:\...\WebCompanion.resources.dll, PE32 28->77 dropped 79 67 other files (none is malicious) 28->79 dropped 119 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 28->119 121 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 28->121 123 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 28->123 125 Modifies Internet Explorer zone settings 28->125 37 cmd.exe 1 28->37         started        40 WebCompanion.exe 16 36 28->40         started        43 sc.exe 1 28->43         started        45 2 other processes 28->45 file12 signatures13 process14 dnsIp15 113 Uses netsh to modify the Windows network and firewall settings 37->113 47 netsh.exe 3 37->47         started        49 conhost.exe 37->49         started        87 wc-partners.lavasoft.com 64.18.87.82, 49726, 49727, 80 MTOCA Canada 40->87 89 sg-bitmask.adaware.com 104.16.235.79, 443, 49744 CLOUDFLARENETUS United States 40->89 91 5 other IPs or domains 40->91 51 conhost.exe 43->51         started        53 conhost.exe 45->53         started        55 conhost.exe 45->55         started        signatures16 process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/703d46e527cbce0c838146a5bb4d93593fb2942ae8dda6cd4d017c5de510549e/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2021-03-18 03:34:00 UTC
AV detection:
9 of 28 (32.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oa6unzjhzphaza4bi2s3wtmtle73ffbk5do2ntknaf6f3ziqkspa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/210322-861bb2drk6/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Enumerates physical storage devices
Loads dropped DLL
Unpacked files
SH256 hash:
89e24e4124b607f3f98e4df508c4ddd2701d8f7fcf1dc6e2aba11d56c97c0c5a
MD5 hash:
cab75d596adf6bac4ba6a8374dd71de9
SHA1 hash:
fb90d4f13331d0c9275fa815937a4ff22ead6fa3
Link:
https://www.unpac.me/results/84cc3dd9-c6f1-4e57-aefa-773c38d87b0a/
SH256 hash:
703d46e527cbce0c838146a5bb4d93593fb2942ae8dda6cd4d017c5de510549e
MD5 hash:
88f216ee25f70ed0704d8cc796ecd277
SHA1 hash:
3e93b8236c7a6e82f50448b03f68d8ba662508f3
Link:
https://www.unpac.me/results/84cc3dd9-c6f1-4e57-aefa-773c38d87b0a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/703d46e527cbce0c838146a5bb4d93593fb2942ae8dda6cd4d017c5de510549e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/126075/

Comments