MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 795c5fdf20b654e3c694d88b350211f3d292ad6e669e296dc8e388a963bdb8dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	795c5fdf20b654e3c694d88b350211f3d292ad6e669e296dc8e388a963bdb8dc
SHA3-384 hash:	50c1f0fc0c488ad364eae18fa65658125b1903b3ad8a7a990f44aac05ccdb567785765532ea9e6461f49025af70a001b
SHA1 hash:	eea4df1d51afd17177ac93e3cdcf6162812bb77c
MD5 hash:	011ed93b7833712bd817e01fbe97bade
humanhash:	mars-steak-enemy-pizza
File name:	MariyelsTherapy.rar
Download:	download sample
File size:	82'890'690 bytes
First seen:	2024-03-21 14:57:37 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	1572864:A76LBY8oxA4kMvYQxwrBZHBFdNYZvpXuyUsAIW:ACuLxA4kMRxEzFCHUsA3
TLSH	T10F08337B26597275F85031FC1D386AFBEA14A46127D075D37CBFA9828CCA8C22C5C86D
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	beansoup
Tags:	discord rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

125

Origin country :

NL

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Potential files of interest 1

File name:	MariyelsTherapy.exe
File size:	82'890'506 bytes
SHA256 hash:	322ed0ee5b695d3b79ab462988ec454df447cb1cfdda8e86b93f2d17e5725370
MD5 hash:	e0dd1ab02bab34ec5bdece209da15877
MIME type:	application/x-dosexec

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/65fc4afff074ad892e590e87/reports/981a9898-8e7f-4ccb-8cb4-857faee06a75/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/795c5fdf20b654e3c694d88b350211f3d292ad6e669e296dc8e388a963bdb8dc

Nucleon Malprob Benign

Score:

6%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/795c5fdf20b654e3c694d88b350211f3d292ad6e669e296dc8e388a963bdb8dc

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pfof7xzawzkohruu3cftkaqr6pjjfllom2pcs3oi4oeksy55xdoa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/240321-va5reacd35/

Behaviour

Enumerates processes with tasklist

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Enumerates physical storage devices

Checks installed software on the system

Looks up external IP address via web service

Drops startup file

Executes dropped EXE

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.