MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76a56c8d14604cc77de9d30ff8efb7b123a9ff793aac402774e8e55040087c99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76a56c8d14604cc77de9d30ff8efb7b123a9ff793aac402774e8e55040087c99
SHA3-384 hash: 92f75c89753075278aae7849d37b568bf69fea137312db552f7f6e2926a8215009b0d07820e9956a2c762859ecac009b
SHA1 hash: e912570ba2f79dcab9a92b70bbf9cc04fd9e13e9
MD5 hash: 16c934a957f24b34a926aa9493332be8
humanhash: sodium-happy-yellow-mars
File name:76a56c8d14604cc77de9d30ff8efb7b123a9ff793aac402774e8e55040087c99
Download: download sample
File size:274'432 bytes
First seen:2023-10-06 14:31:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 724aec23791dc9e5f1409691def0c3fb
ssdeep 6144:D/gsy8X4XYdWvAXOOice8mCj0ohXEofBev:D/HtoXYdWvA90o1fk
Threatray 1 similar samples on MalwareBazaar
TLSH T11A448C0972D41CB5DDB7C239CD635D46E672BC260631EA2F13A1271ADE3B390992BB31
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter Anonymous
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
264
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W64.Kryptik.KUK.gen.Eldorado.11768.17094.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control greyware lolbin packed
Link:
https://www.filescan.io/uploads/65201a649b16696e9f93d4e0/reports/854112f4-ccad-4958-8604-3211ea9d38e7/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/76a56c8d14604cc77de9d30ff8efb7b123a9ff793aac402774e8e55040087c99
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/1b2b7a50-aa9a-474d-9502-b0ba0338e675
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76a56c8d14604cc77de9d30ff8efb7b123a9ff793aac402774e8e55040087c99/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-10-06 03:51:27 UTC
File Type:
PE+ (Dll)
Extracted files:
8
AV detection:
14 of 23 (60.87%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o2swzdiumbgmo7pj2mh7r35xwer2t73zhkweaj3u5dsvaqaipsmq._file
Verdict:
malicious
Similar samples:
84652a0515f73f10af71032ee2273b7c73a2dd258d797bc20be350c74ed1d00d
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/231006-rwaavafa77/
Unpacked files
SH256 hash:
cbf938b5d8060e6bfdb0f6cd0bc97f95d186a243ee07e47064e353321d76ec93
MD5 hash:
09f974f62cbdcf5f065fb71dfe8056c6
SHA1 hash:
02bf11f2377807698cc2340287a1ce9d0a843b8b
Detections:
IcedIDLoaderFork
Create hunting rule
Link:
https://www.unpac.me/results/07eb4a95-1796-4ee4-9ec6-4512276f5d6e/
SH256 hash:
76a56c8d14604cc77de9d30ff8efb7b123a9ff793aac402774e8e55040087c99
MD5 hash:
16c934a957f24b34a926aa9493332be8
SHA1 hash:
e912570ba2f79dcab9a92b70bbf9cc04fd9e13e9
Link:
https://www.unpac.me/results/07eb4a95-1796-4ee4-9ec6-4512276f5d6e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/76a56c8d1460/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76a56c8d14604cc77de9d30ff8efb7b123a9ff793aac402774e8e55040087c99

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments