MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71664ca9b4d0ca2030a0bb792ae8d6c6791fb57f71ed061899af6dda9c06630a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 71664ca9b4d0ca2030a0bb792ae8d6c6791fb57f71ed061899af6dda9c06630a
SHA3-384 hash: c302e9b0d2160bdf17da33f7a293e672498336f111b714d5a139566f2286f5bad069be23985a42d9f6d7fea824a37b35
SHA1 hash: 4a3528be37db1c17e7a35e80e4ce3428acc5c345
MD5 hash: 22e3e2cd29464e9bd0a377c8d5e1f049
humanhash: london-magnesium-cup-king
File name:71664ca9b4d0ca2030a0bb792ae8d6c6791fb57f71ed061899af6dda9c06630a
Download: download sample
File size:2'471'424 bytes
First seen:2023-05-04 14:01:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 24576:W12+qdrzi/y4grJ3uC3OSCxE+4WS8+04svlvmLBQLQtv2NfQSA5W1JYLKFXY/TRl:gnK0OyEZV4AQxQSoK+TRNlUi
Threatray 59 similar samples on MalwareBazaar
TLSH T138B50232369AFED5D76F0D38E48B15400E949CEB9768C1647CC802EBA1B37A4ED71A71
TrID 56.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon ece4a494acb4b0a4 (3 x zgRAT, 1 x PureCrypter)
Reporter adrian__luca
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
252
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
71664ca9b4d0ca2030a0bb792ae8d6c6791fb57f71ed061899af6dda9c06630a
Verdict:
Malicious activity
Analysis date:
2023-05-04 14:01:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7279298e-8650-4559-baf7-3bcd5fb032bc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/386561/
Detection(s):
SecuriteInfo.com.Variant.MSILHeracles.78764.15282.22427.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Running batch commands
Creating a file in the %AppData% directory
Using the Windows Management Instrumentation requests
Enabling autorun
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6453badba020199dc647bf31/reports/0045c4e0-43a5-43c0-ada5-4c7f99479ffd/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/71664ca9b4d0ca2030a0bb792ae8d6c6791fb57f71ed061899af6dda9c06630a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/daa695a2-e94a-47b4-b062-21aaa86f4ec0
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1226242
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an undocumented autostart registry key
Encrypted powershell cmdline option found
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 859204 Sample: oDPW1n0RpB.exe Startdate: 04/05/2023 Architecture: WINDOWS Score: 80 29 Antivirus detection for dropped file 2->29 31 Antivirus / Scanner detection for submitted sample 2->31 33 Multi AV Scanner detection for dropped file 2->33 35 Multi AV Scanner detection for submitted file 2->35 7 oDPW1n0RpB.exe 1 7 2->7         started        process3 dnsIp4 27 51.254.53.17, 7785 OVHFR France 7->27 23 C:\Users\user\AppData\...\Sarctg546Soft.exe, PE32+ 7->23 dropped 25 C:\...\Sarctg546Soft.exe:Zone.Identifier, ASCII 7->25 dropped 37 Creates an undocumented autostart registry key 7->37 39 Encrypted powershell cmdline option found 7->39 12 cmd.exe 1 7->12         started        15 powershell.exe 16 7->15         started        file5 signatures6 process7 signatures8 41 Encrypted powershell cmdline option found 12->41 17 powershell.exe 16 12->17         started        19 conhost.exe 12->19         started        21 conhost.exe 15->21         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/71664ca9b4d0ca2030a0bb792ae8d6c6791fb57f71ed061899af6dda9c06630a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-04 14:02:09 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
10
AV detection:
15 of 37 (40.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oftezknu2dfcamfaxn4sv2gwyz4r7nl7ohwqmgezv5w5vhagmmfa._file
Verdict:
malicious
Similar samples:
112466c6694ff308605d790a0c91b702d949a635a4f8a3e8129f65d6fbcb58df
12a5158d4768fb51739e6b0fc155057116e20228c7ab22ef3e08dbfdca2e13ad
6885a9ebd3e4a2d367b385f8d846f528bacfc944b7be6f1e2eca12d6c951a7d5
6958b67fa4b8e6b4cb8a503cb6199b81c6df7491a97ec8edf51662e350078fda
82a3a3234c7dbddf79b32b1cf05cd7d5806512824d0536edcbce4dc529519d92
879b5fef5bd8bbd8a81ae74de86e38f88f60e4da9aa35941ee3e676ebc386718
9142931e43055d6363ee826270edf47ada8acc56ebca1084ca9ee2fcca579536
9206df8f28b1540fa4f76fc385b2d786fadaef5cf7b0e24e5218ff7fff0fcbad
a0959f72e13211452dc49f9359f43d5b7df3a98fb24f0fbaf0ec2c29d85bb1ec
fd24ac75f267d1cc406697651273087eaf7c5f86ff59d323fdf66a41915429b0
+ 49 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/230504-rb4nysef7v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
71664ca9b4d0ca2030a0bb792ae8d6c6791fb57f71ed061899af6dda9c06630a
MD5 hash:
22e3e2cd29464e9bd0a377c8d5e1f049
SHA1 hash:
4a3528be37db1c17e7a35e80e4ce3428acc5c345
Link:
https://www.unpac.me/results/5fe2f33f-106f-4669-882f-abaf1f71fad3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/71664ca9b4d0ca2030a0bb792ae8d6c6791fb57f71ed061899af6dda9c06630a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/386561/

Comments