MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73ca09511af9e87794dc404ad8b6bf500ac58e1eba339946fd84a57c55d0b94f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73ca09511af9e87794dc404ad8b6bf500ac58e1eba339946fd84a57c55d0b94f
SHA3-384 hash: 0f882842cd2452af5db943c4fcc61082999abbb78991d5dadb1264075654fd0850bf63da8ac6c05de4c520167aa4a0da
SHA1 hash: 4f8bae3976432c6809c18f264cbb9842f60cd43b
MD5 hash: 27335314d2b48e452529904f798a7f83
humanhash: nitrogen-seventeen-arkansas-stairway
File name:Kkoymf_Ivkeekfe.exe
Download: download sample
File size:1'366'016 bytes
First seen:2022-04-15 10:02:54 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 24576:T0KdSftT3QrMcdAG364yfh/3YIT1nr0PO:6QrTlGhdpwP
Threatray 2'514 similar samples on MalwareBazaar
TLSH T1F2555E04A2F3CF93D30A4F3BE4E6484147A6D261AAC6F71E35ED427D68033E6495BB49
TrID 83.7% (.DLL) Generic .NET DLL/Assembly (236632/4/32)
4.6% (.SCR) Windows screen saver (13101/52/3)
3.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter proxylife
Tags:dll Lokibot

Intelligence

File Origin
# of uploads :
1
# of downloads :
416
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/263971/
Detection(s):
SecuriteInfo.com.MSIL.Injector.VXR.19234.20891.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/625942d7eab80a7a6c1b1cb9/reports/b968cab7-15b3-4250-bed9-05da7395abbb/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8d87c4aa-9f95-40fc-8189-2075ffa3437f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/977370
Signature
.NET source code references suspicious native API functions
Sigma detected: Suspicious Call by Ordinal
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 609857 Sample: Kkoymf_Ivkeekfe.exe Startdate: 15/04/2022 Architecture: WINDOWS Score: 48 13 .NET source code references suspicious native API functions 2->13 15 Sigma detected: Suspicious Call by Ordinal 2->15 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        process5 11 rundll32.exe 9->11         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/73ca09511af9e87794dc404ad8b6bf500ac58e1eba339946fd84a57c55d0b94f/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-04-15 10:03:11 UTC
File Type:
PE (.Net Dll)
Extracted files:
3
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
39d180e2f5c447706ad8e4f2fc0a86c2cbd586426dd1343f37f3008569f1a60b
81f87505081c9fae48db9fc5098b1799c95b92ce2f0094fc69885a176651775b
857db12e49d1aeee4af4010346212c0e86eeb05b3edd28e8d48df05f343bdd87
8dd2ea100a46b99ad89e7754af2dbd306ce5ec10e214687edd629aa6b7ab4cd6
99ac994cf3d597e69532d73cf8b692a13129d7a7df092ad9d553e4e2c5c175d6
c09a64df71db0720511fcbc521afd0023f121c2b015e57f8ddf773f0850c0f48
d4ac371b6f8d512b5cb6c3dae2b87b66dd750f1d69e80da36ca951b2d04298e2
+ 2'504 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220415-l3b55agffk/
Unpacked files
SH256 hash:
73ca09511af9e87794dc404ad8b6bf500ac58e1eba339946fd84a57c55d0b94f
MD5 hash:
27335314d2b48e452529904f798a7f83
SHA1 hash:
4f8bae3976432c6809c18f264cbb9842f60cd43b
Link:
https://www.unpac.me/results/c70254b8-d970-48e0-bc0c-698e45641b51/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/73ca09511af9e87794dc404ad8b6bf500ac58e1eba339946fd84a57c55d0b94f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:t0_1
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/263971/

Comments


Avatar
proxylife commented on 2022-04-15 10:05:06 UTC

https://terrazzaitaliana.mx/hrt/Kkoymf_Ivkeekfe.bmp

Reversed