MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7432d519a0a8042c26d8fa9637c9c07de4c33cde886feb1fbc063f1a5d828ed4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Pitou


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7432d519a0a8042c26d8fa9637c9c07de4c33cde886feb1fbc063f1a5d828ed4
SHA3-384 hash: 9eab4dd540aa27a30bea70d7b355095032000917d5372496cbfea3df17d116d3b3361b32b885450efc81649183b6dc0a
SHA1 hash: 6c6bd7607711bf14e2e7e922f75e0c175dad91d5
MD5 hash: d4ac8896ed3efaf5abb3dab20804f848
humanhash: oxygen-speaker-summer-bravo
File name:SecuriteInfo.com.Variant.Bulz.596109.8199.17580
Download: download sample
Signature Pitou
Create hunting rule
File size:698'368 bytes
First seen:2021-08-10 12:47:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cc4caabe2c1a9c923331965c9764375d (3 x Pitou, 2 x RedLineStealer, 2 x GCleaner)
ssdeep 12288:AVtBliBgddthoOzmmQ6SZCQNTJhFVANU4ViJ176sy:2HAgdeHxf7ANU4gfJy
Threatray 14 similar samples on MalwareBazaar
TLSH T1F3E4E130B790C030F4B701F855BA97BCB92E7AA2577451CF92D11AEE5B286E4AD30397
dhash icon 68e8e8e8aa66a499 (33 x RaccoonStealer, 14 x ArkeiStealer, 11 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:exe Pitou

Intelligence

File Origin
# of uploads :
1
# of downloads :
896
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.Bulz.596109.8199.17580
Verdict:
Malicious activity
Analysis date:
2021-08-10 12:49:43 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/59207dff-40d6-45ae-8bae-34403c1d6bee

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/177913/
Detection(s):
SecuriteInfo.com.Variant.Bulz.596109.8199.17580.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Blocking the Windows Defender launch
Rewriting of the hard drive's master boot record
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Pitou
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c5ff0639-64c4-40c2-b83a-eb94f408678e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/830145
Signature
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7432d519a0a8042c26d8fa9637c9c07de4c33cde886feb1fbc063f1a5d828ed4/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2021-08-10 10:49:15 UTC
AV detection:
18 of 27 (66.67%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
281de330768f7e2231f3984b2fbac04bf9f7f2b2d4fb3c2f91d6ba2eab8d546c
Pitou
66cebd1b0a87df2ddcd805723d15e8094c23dfe1d4a2108348579995a102c994
Pitou
6feed7d5f7d9776c69963076fdb46de01b8ff9253a84b9e086e0beefc85a181d
Pitou
829f2d1a30848cec9b28b47782537ad64a3770d6b22359c0d3f5257215b49105
Pitou
99ddbc06f3ec84f50661bb88036fd872308af6f5841a9730cc020c5b7467a3c0
Pitou
b7de56f8c1d25037dbded37355d0cd8219f68d38683913de1e000c2c50159143
Pitou
ce1c2e089ab14ef543b6604bd4fd82213708b89372fd63d414ff6e694ddce4ad
Pitou
dbb1ffb8a8b13b389fd8aff976808226333bc23d8aafc33111b88206f498fcea
Pitou
f69bdd82ca22268d090832707e37b1cae408ba96476843b55feedac11acc6277
Pitou
fb2e2174a3ec526861932043c1aa5b5e62e3abed0bb73e88e495eab66635e758
Pitou
+ 4 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
bootkit persistence
Link:
https://tria.ge/reports/210810-p5lljc1v46/
Behaviour
Suspicious use of AdjustPrivilegeToken
Writes to the Master Boot Record (MBR)
Unpacked files
SH256 hash:
40952c341d05273c0c581ee26718e131666f4def5ae9839c686ba5e6bd57ba7d
MD5 hash:
7a37018d3bb55b535803345f8dfc14db
SHA1 hash:
008e8644fec789c07acea71ebd5a31742a3fa42c
Detections:
win_pitou_auto
Create hunting rule
Link:
https://www.unpac.me/results/7ba65c11-1705-4504-84cb-93610ce4a1e7/
Parent samples :
829f2d1a30848cec9b28b47782537ad64a3770d6b22359c0d3f5257215b49105
ce1c2e089ab14ef543b6604bd4fd82213708b89372fd63d414ff6e694ddce4ad
66cebd1b0a87df2ddcd805723d15e8094c23dfe1d4a2108348579995a102c994
7432d519a0a8042c26d8fa9637c9c07de4c33cde886feb1fbc063f1a5d828ed4
dd1dc97c210d7ed5cfe8c72bd8dd28bb080dcf1444d9770fdd7c5c436de345e5
b6b28602888cb4f4335d3e02a0a91cd945a64f1c5cd6372cf70aad05dc5c0d30
440de5c3ce1c9cf276516354babcae98f726b2f6a16d747f5ca2154b0e450410
d7eecb951a6b4439f8b71fc6b6d71b1892ee0c3ca26ae2e3fda22960515d8963
4004d8d0d2163211efed5e32a184c3842f643f02b29c5b619bb4ef97a8afc3e6
SH256 hash:
7432d519a0a8042c26d8fa9637c9c07de4c33cde886feb1fbc063f1a5d828ed4
MD5 hash:
d4ac8896ed3efaf5abb3dab20804f848
SHA1 hash:
6c6bd7607711bf14e2e7e922f75e0c175dad91d5
Link:
https://www.unpac.me/results/7ba65c11-1705-4504-84cb-93610ce4a1e7/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7432d519a0a8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7432d519a0a8042c26d8fa9637c9c07de4c33cde886feb1fbc063f1a5d828ed4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Pitou

Executable exe 7432d519a0a8042c26d8fa9637c9c07de4c33cde886feb1fbc063f1a5d828ed4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1521622/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/177913/

Comments