MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79566bb3c1421220ae07285c74add2c31f5bb79c91cd5c7cea90e98edbe13c34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79566bb3c1421220ae07285c74add2c31f5bb79c91cd5c7cea90e98edbe13c34
SHA3-384 hash: 56cbad2272c3b5281e872c42371c6eecaf6785b3f6d9675a7edff9145e2152cf02f43447e9d6c3141e95648e8ff1cf05
SHA1 hash: a92789b5fcc9802a910ba3973ebcb26e1273c809
MD5 hash: c03b2b8302fd9c5ca1bf10aeebe506c8
humanhash: fish-beryllium-beer-dakota
File name:c03b2b8302fd9c5ca1bf10aeebe506c8.exe
Download: download sample
File size:1'168'021 bytes
First seen:2021-12-16 09:22:24 UTC
Last seen:2021-12-16 11:17:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5094bd6be83536db48f1eec7300c4330 (1 x RedLineStealer)
ssdeep 6144:PerZbU7CP5hDeK1GoFpiTB4iSP2Re8J2xiSP2Re8J2xiSP2Re8J2xiSP2Re8J2:m5U7CPHik7piTBFk8k8k8k
Threatray 32 similar samples on MalwareBazaar
TLSH T106459F319561E01BD98741F6FBAF8AACE44E5C40874811D76A38A9BB01391F0EEF7E47
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/214540/
Detection(s):
SecuriteInfo.com.Trojan.Siggen16.6686.32687.19169.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Launching a process
Creating a process with a hidden window
DNS request
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Sending an HTTP POST request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug greyware overlay
Link:
https://www.filescan.io/uploads/61bb057d8541392eb4ea46c5/reports/21eb97b5-789f-4b1b-865c-6f5abaf4c822/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b4b01788-b8cb-4809-b293-b44bcd2eb88b
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/908404
Signature
Bypasses PowerShell execution policy
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 process2 2 Behavior Graph ID: 540880 Sample: wWLjDhQD3D.exe Startdate: 16/12/2021 Architecture: WINDOWS Score: 68 7 wWLjDhQD3D.exe 2->7         started        signatures3 19 Detected unpacking (changes PE section rights) 7->19 21 Detected unpacking (overwrites its own PE header) 7->21 23 Bypasses PowerShell execution policy 7->23 25 2 other signatures 7->25 10 wWLjDhQD3D.exe 2 7->10         started        process4 process5 12 powershell.exe 15 20 10->12         started        dnsIp6 17 45.77.127.230, 8888 AS-CHOOPAUS United States 12->17 15 conhost.exe 12->15         started        process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79566bb3c1421220ae07285c74add2c31f5bb79c91cd5c7cea90e98edbe13c34/
Threat name:
Win32.Trojan.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-12-16 09:23:10 UTC
File Type:
PE (Exe)
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
125f727400ec902951c8588d5f6077e199238c2d428144f5bb83d1fc6a22dac2
2ff3f8766332a55fd714923c8822ef236f772551b32e25c2068eb19c9215ed67
5d4350bcfecb0746c8aebf6f31052ea95b1901d558e27215bb0197e50f3b9e5c
6746b12200fed6aeb1764594c84ecd3485e74114325c150ba41d12c555b182eb
74685c3c571f81e1eb2fcbaaca74a9bf792a73b629568ce7571aca5d710f1647
7bb4e30a5272731a9b846b4274aa84662026814b0d610c0c115158be1cd23332
86aab09b278fe8e538d8cecd28f2d7a32fe413724d5ee52e2815a3267a988595
89b4b266845420410683c6452a44e0aba4102d0f0e153893a2d1f74d047b6f0a
98e9809d1b0e795975f710675b156430ea45f6a29dd2318d8936f279f6cad2dc
ae90567ca1a3f4dfc430ae9d6cfa5139385c418b6b70f01c2dd4931dc76ff97b
+ 22 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/211216-lcgmxscdhk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Blocklisted process makes network request
Malware Config
Dropper Extraction:
http://45.77.127.230:8888
Unpacked files
SH256 hash:
f98086eee6a14399294f7e720fa2daea803b2e7a7215301b613486dc09861122
MD5 hash:
e77224e78c7332461fa475c368bd3024
SHA1 hash:
71aa9920cdd83e3746bd61249f4bae0ae708a317
Link:
https://www.unpac.me/results/d47696a1-c07d-42f1-b0d9-52e55bc73a79/
SH256 hash:
79566bb3c1421220ae07285c74add2c31f5bb79c91cd5c7cea90e98edbe13c34
MD5 hash:
c03b2b8302fd9c5ca1bf10aeebe506c8
SHA1 hash:
a92789b5fcc9802a910ba3973ebcb26e1273c809
Link:
https://www.unpac.me/results/d47696a1-c07d-42f1-b0d9-52e55bc73a79/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/79566bb3c1421220ae07285c74add2c31f5bb79c91cd5c7cea90e98edbe13c34

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:WIN32_MALWR_DROPPER_INJECTOR_RANSOMWARE
Create hunting rule
Author:Jesper Mikkelsen
Description:Detect Suspicous dropper injector - possible ransomware dropper
Reference:SHA-1:0feda1e7b0d4506270c85973826fa498e9ed0f5b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 79566bb3c1421220ae07285c74add2c31f5bb79c91cd5c7cea90e98edbe13c34

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/214540/
  
URLhaus
https://urlhaus.abuse.ch/url/1892568/
  
Delivery method
Distributed via web download

Comments