MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 736e6a96ccdff0e9f90c8a7dcbd759722384e6eb41f963033075d36923654d45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.LoadMoney


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 736e6a96ccdff0e9f90c8a7dcbd759722384e6eb41f963033075d36923654d45
SHA3-384 hash: 1e79fea85a5cc2a7abe0e6b0fa11c3ea732ea80516ecabd91b151d4ad66e9c2f7ee22bdd3867c2676da23988a888c45e
SHA1 hash: 773ffb54d68becd5a401fcf38fd87908982ccfba
MD5 hash: afe1d20f512618e0220d0b40eb726a60
humanhash: venus-double-king-pluto
File name:736e6a96ccdff0e9f90c8a7dcbd759722384e6eb41f963033075d36923654d45
Download: download sample
Signature Adware.LoadMoney
Create hunting rule
File size:1'300'480 bytes
First seen:2021-09-13 07:46:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:dBG2bDgfxhWOxOJxe5p9AVb/yoMLbuyms22yxX2pPHGQZqK799ZsR:pb8frxxsx1/yoE+XoHNk29L
Threatray 71 similar samples on MalwareBazaar
TLSH T11A5522BDA7DD4F79D35B0A78E9E152400738D61B87CBC71F508458F4A8927CB9A83A0B
dhash icon 00ca80c2c2808200 (36 x njrat, 4 x AsyncRAT, 4 x Smoke Loader)
Reporter JAMESWT_WT
Tags:Adware.LoadMoney exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
736e6a96ccdff0e9f90c8a7dcbd759722384e6eb41f963033075d36923654d45
Verdict:
Suspicious activity
Analysis date:
2021-09-13 08:32:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1b5feef3-818c-442d-95ea-f122879dd7a8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/187321/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm obfuscated packed
Link:
https://www.filescan.io/uploads/6174fd789a5a1e91c5d1f92a/reports/ef0d8eac-0fa9-4646-a93d-6f4e3c943237/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9d575aeb-fb25-4bd2-80f8-871d4d8c2e6f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/849704
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/736e6a96ccdff0e9f90c8a7dcbd759722384e6eb41f963033075d36923654d45/
Threat name:
ByteCode-MSIL.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2021-09-03 21:57:45 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
21 of 45 (46.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=onxgvfwm37yot6imrj64xv2zoiryjzxlih4wgazqoxjwsi3fjvcq._file
Verdict:
malicious
Similar samples:
1d9792547b612f5521083edcdf440a8e6dece47d056e69bed5b08575c57c44ff
Adware.LoadMoney
57233018ececa82dadc167ce51622ecb6b06a4c08753c951a2a5e91f4b3629de
Adware.LoadMoney
5c616e633ee33cf1ebc784661459a1990201bc9baf77c6c59a8ee5d1b25dcde4
Adware.LoadMoney
76ff41be8f7f15dbb035fb27ad00cbd313d0d75745945b81642f10986fc83ffb
Adware.LoadMoney
8759d45e142c15d4e4cc63fc147114ef52bb57623710552c4ba76f43face2524
Adware.LoadMoney
9465d1ee02521fdd0d1be313df401af7734a858c164e4eae77d6c85398e339eb
Adware.LoadMoney
9f549d7c1524df9f8b0dd28d440a0c55bb3ef49c1c9114b43e67545ca727e9d9
Adware.LoadMoney
d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305
Adware.LoadMoney
db4b9e3a0264451368c24fb5f9e9a8722bb0afc6fb184fca9a54b7cb1aec4249
Adware.LoadMoney
+ 61 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/210913-jmjh6agcdk/
Behaviour
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
Drops desktop.ini file(s)
Unpacked files
SH256 hash:
6d24235d6ca8637abc4696aa44f548cef79b3474401eb6785f5816b9e0c54a17
MD5 hash:
5d047cbbde183c62422215b06a081ce6
SHA1 hash:
f65186762b47f05a3ab6600ff6e8045dcb405aac
Link:
https://www.unpac.me/results/7ac4085e-b267-4027-bddd-ccc6ae904852/
SH256 hash:
09ce02a58c92533da6f8dfd9005e8cab48caa02b5f8ca3718617d6053801f3a1
MD5 hash:
4855d5e96f85082c685ae3aaf68559fa
SHA1 hash:
7af5a9cc5993ab1b685406f6c0ddb019a28e7df3
Link:
https://www.unpac.me/results/7ac4085e-b267-4027-bddd-ccc6ae904852/
SH256 hash:
736e6a96ccdff0e9f90c8a7dcbd759722384e6eb41f963033075d36923654d45
MD5 hash:
afe1d20f512618e0220d0b40eb726a60
SHA1 hash:
773ffb54d68becd5a401fcf38fd87908982ccfba
Link:
https://www.unpac.me/results/7ac4085e-b267-4027-bddd-ccc6ae904852/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.58
Link:
https://yomi.yoroi.company/submissions/736e6a96ccdff0e9f90c8a7dcbd759722384e6eb41f963033075d36923654d45

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/187321/

Comments