MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79a129abb141286ddc2af3ad937773a10701215cbff6b26a8b2217aa95c1c66c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	79a129abb141286ddc2af3ad937773a10701215cbff6b26a8b2217aa95c1c66c
SHA3-384 hash:	ac1b767fb1e8196f695518576e580a6d86ff7ad431c9b89d199b935d8997f371dcb75cee4bcdb8cd5b11565a4cc3819b
SHA1 hash:	523e90fadc3753fc3e40e9bfb41a3b476f4eac95
MD5 hash:	ed4be3d3741f92eb9a51c264b06a9d68
humanhash:	violet-north-vegan-vegan
File name:	file
Download:	download sample
File size:	2'671'906 bytes
First seen:	2023-11-08 12:57:56 UTC
Last seen:	2023-11-08 16:26:27 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f4639a0b3116c2cfc71144b88a929cfd (96 x GuLoader, 53 x Formbook, 37 x VIPKeylogger)
ssdeep	49152:C42s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsW:CIzX71oDCRAZUviAHImDqia7hsW
TLSH	T1B9C523007241DC42DDB906F41C6AE2BA10743FBB641EB96337817AFE2AF6E31954F256
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	80a4a6a4a6a6a480 (1 x RustyStealer)
Reporter	andretavare5
Tags:	exe

andretavare5

Sample downloaded from http://194.49.94.67/files/InstallSetup2.exe

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

327

Origin country :

US

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

http://194.49.94.67/files/InstallSetup2.exe

Verdict:

Malicious activity

Analysis date:

2023-11-08 15:25:30 UTC

Tags:

evasion loader stealc stealer

Link:

https://app.any.run/tasks/7271a8fd-1c06-4a08-a9b9-0140ff3cc66a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.Malware@#1o2coqjl0l2yj.2594.21486.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a process from a recently created file

Сreating synchronization primitives

Creating a window

Searching for synchronization primitives

Searching for the window

DNS request

Dragonfly

Gathering data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/654b85f0db1a8dc94d4f4e96/reports/27283e7c-66f8-4600-be3b-bd7e1c683d8e/overview

Hybrid Analysis Doina.Generic

Verdict:

Malicious

Labled as:

Doina.Generic

Link:

https://www.hybrid-analysis.com/sample/79a129abb141286ddc2af3ad937773a10701215cbff6b26a8b2217aa95c1c66c

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/9ed0265c-b692-48a8-bb08-b53f05268ea5

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1339030

Signature

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/79a129abb141286ddc2af3ad937773a10701215cbff6b26a8b2217aa95c1c66c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/79a129abb141286ddc2af3ad937773a10701215cbff6b26a8b2217aa95c1c66c/

ReversingLabs TitaniumCloud Win32.Trojan.Privateloader

Threat name:

Win32.Trojan.Privateloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-11-08 12:58:06 UTC

File Type:

PE (Exe)

Extracted files:

113

AV detection:

17 of 24 (70.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pgqstk5rieug3xbk6owzg53tuedqcik4x73le2uleil2vfobyzwa._file

Threatray malicious

Verdict:

malicious

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/231108-p7gsysda45/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes dropped EXE

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

2e36d434f835b4ac79fb8c01e0ddf32b2abae5a6e8cc10641ff575900e257851

MD5 hash:

511b48b37b400deaf218bcbc5e5d5286

SHA1 hash:

0b4a7bbb26b2f426a10b50b5c50adb1e93392908

Link:

https://www.unpac.me/results/ab98827a-2c55-4148-93b4-17334f9376da/

SH256 hash:

79a129abb141286ddc2af3ad937773a10701215cbff6b26a8b2217aa95c1c66c

MD5 hash:

ed4be3d3741f92eb9a51c264b06a9d68

SHA1 hash:

523e90fadc3753fc3e40e9bfb41a3b476f4eac95

Link:

https://www.unpac.me/results/ab98827a-2c55-4148-93b4-17334f9376da/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/79a129abb141286ddc2af3ad937773a10701215cbff6b26a8b2217aa95c1c66c