MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78b72afacd7cc1e7de8b582710768720e6af971bfde2c6e3490d85b97dbe9a10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78b72afacd7cc1e7de8b582710768720e6af971bfde2c6e3490d85b97dbe9a10
SHA3-384 hash: a470fb393429f6c8c62d7bfe21ec173e620e2381a2ec7f0660be091cea05eda9a08c18d085ad2207b1a1e3b64e454be1
SHA1 hash: 3f42175d8a12b17c24907f70e5bc980a0955501a
MD5 hash: 846cc7c57ac08b0ec42b6df602685e56
humanhash: mexico-venus-zulu-delaware
File name:SecuriteInfo.com.Trojan.Inject3.5737.28651.11919
Download: download sample
File size:2'076'672 bytes
First seen:2022-12-04 08:26:59 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
ssdeep 24576:GcpVLSiybl1F5k5ZmaLpsac0vrwA34Iw/ntmCPXJZBJxaTzrTwHHk:TpdSik1F5oZmaLpjc0DwMgtrRJxQwHE
Threatray 57 similar samples on MalwareBazaar
TLSH T191A5CED13749C126CA5719358F67D79A172AFCE1AE30B08737A0BB5E4B38AD3AD25301
TrID 39.5% (.EXE) InstallShield setup (43053/19/16)
28.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
9.6% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter SecuriteInfoCom
Tags:dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/342480/
Detection(s):
SecuriteInfo.com.Trojan.Inject3.5737.28651.11919.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
expand.exe fingerprint overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/638c59eb527933be940d4354/reports/a37a6b33-6a58-4bab-89c3-603b382a7db7/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b3aa6976-0f55-4310-80e9-9233d190090f
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
3 / 100
Link:
https://www.joesandbox.com/analysis/1127365
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78b72afacd7cc1e7de8b582710768720e6af971bfde2c6e3490d85b97dbe9a10/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pc3sv6wnpta6pxullatra5uhedtk7fy37xrmny2jbwc3s7n6tiia._file
Verdict:
unknown
Similar samples:
101a5477169067b0d4df475dca5ed8ae2c99b3916664b6d32aeb5113541ee5be
3bd5892cdc82dc4576eaf2735edb57182ae8b91c8067be305d4e801197d390cc
49a89b01989834ff1126f061cb875ee52f837f6cd27872a3f269dbaf17e97b2b
5189b2a9e69b48ef464f8f59ab722717ab162eb33ab7f493791f13e28d59473e
5aa44499656e987152e9c8529a5c1e26ea672f8891dfd2f7729312bbc13b0a71
76c73380cc4deb30cbfbe8a7fd551da5aba1150505fb5b0b66599e4ba491848b
d7782d882376d64085dcc1fc3e85030da3c37201922a9a73ca04b1b1f7957257
e867b0089c8de42336fda26cb236f1560fade689995da8761637d45980f16986
fb9f0bf2b71bf576053c56cb913ea4e93581fc9d3aa9d6d8a0ae572a1622f050
fba454b0f86b6514c9d9e5268ed58a398d30443819ec887fbc2b02d590dc1522
+ 47 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/221204-kclq7sfg6t/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
78b72afacd7cc1e7de8b582710768720e6af971bfde2c6e3490d85b97dbe9a10
MD5 hash:
846cc7c57ac08b0ec42b6df602685e56
SHA1 hash:
3f42175d8a12b17c24907f70e5bc980a0955501a
Link:
https://www.unpac.me/results/93c44292-7377-4566-9575-5f03f954de38/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/78b72afacd7cc1e7de8b582710768720e6af971bfde2c6e3490d85b97dbe9a10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/342480/

Comments