MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79b602eb2703918564bbfa01cded77f8e8308adbeec88a6709d2d78f7509a9a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79b602eb2703918564bbfa01cded77f8e8308adbeec88a6709d2d78f7509a9a9
SHA3-384 hash: 750047fb74286f4e87033f2c61fed946be1a752fa9800aab5c06d29d8f5e77550ba59b17c702c78d95f3bf1887428f5e
SHA1 hash: bcc57bd87f1a1092dc940f3605924e5f1cd72495
MD5 hash: c9c98456e3540cb3dc80ef41a3c6e4e8
humanhash: black-minnesota-fanta-zulu
File name:SecuriteInfo.com.Trojan.MulDrop24.61037.18835.15227
Download: download sample
File size:2'939'184 bytes
First seen:2024-02-05 06:18:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0ae9e38912ff6bd742a1b9e5c003576a (10 x DCRat, 7 x RedLineStealer, 4 x AsyncRAT)
ssdeep 49152:6ILEYrXdd9Q0O3dWsKe7JrS8kP2SnoWHC5oivS56apE3i32HAS0xlWsFVK:6VYrX7etDX7J++SnoLRopE3AtvFm
TLSH T10AD52311F6C558B2D56324332A306721A9BCBC306FB08EDBA3D996AFDF211D09631B75
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter SecuriteInfoCom
Tags:exe signed

Code Signing Certificate

Organisation:Bitsum LLC
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2023-02-07T00:00:00Z
Valid to:2025-03-08T23:59:59Z
Serial number: 0b494d7df02097107b9065025133fe92
Intelligence: 27 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: b309179e6516e33d374264683b0751db5f23b09e625ff0b6a4163df28051d08c
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
361
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/474569/
Detection(s):
SecuriteInfo.com.Trojan.MulDrop24.61037.18835.15227.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm evasive explorer explorer fingerprint installer keylogger lolbin lolbin overlay packed packed remote rundll32 setupapi sfx shdocvw shell32
Link:
https://www.filescan.io/uploads/65c07dda0b80a40728922e31/reports/ba4659e5-0bf6-4d90-8cf5-6a75d4319410/overview
Verdict:
Malicious
Labled as:
Malware.Dropper
Link:
https://www.hybrid-analysis.com/sample/79b602eb2703918564bbfa01cded77f8e8308adbeec88a6709d2d78f7509a9a9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d12da6c6-5b5a-45ec-b598-99c53bda8caa
Result
Threat name:
n/a
Detection:
clean
Classification:
evad
Score:
16 / 100
Link:
https://www.joesandbox.com/analysis/1386542
Behaviour
Behavior Graph:
n/a
Score:
7%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/79b602eb2703918564bbfa01cded77f8e8308adbeec88a6709d2d78f7509a9a9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79b602eb2703918564bbfa01cded77f8e8308adbeec88a6709d2d78f7509a9a9/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pg3af2zhaoiykzf37ia433lx7dudbcw353eiuzyj2lly65ijvguq._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240205-g26wwscde5/
Behaviour
Checks processor information in registry
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Unpacked files
SH256 hash:
f32fe27436c99c341be384b4a51f617a23eaec4dbb6298a37cb298c3af770b60
MD5 hash:
2cf43bb00e33497ac344e5df3ac3d523
SHA1 hash:
738646a1deb9d953dcd8d0bc15744a0ede348ab6
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
e811a65c438e22d389e9b594636b35c4826b74a35557a84dc12bb3e29e272013
MD5 hash:
e0b309759c28037020ffb729f180daa3
SHA1 hash:
423fef8b19c8aba14bc961f897acba399497dfa4
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
d369b8a56c33e0bf97cee143351cf181941fd2c6a610fb9eb4329374e3873336
MD5 hash:
b559991e70d46595d1ae4138c9545ade
SHA1 hash:
fac729f6bdd82f076af3a66702b7d437f69a1168
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
cff3ff58e23ff75b044f477dfa8742ab5f0c6d0382f146daf537b651ed7576a9
MD5 hash:
58d60b8d590fd66b268e096af34952a2
SHA1 hash:
941348e02714d67ee3a7c7216e5f6e8f9ba8699d
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
ad8c460c30da7bb94577215a175c33c7237cd9d36b8652621247594a785cc9ce
MD5 hash:
287471f6a372835b996238e0f94a6466
SHA1 hash:
2b844f792cc962b5d19524982509b1b80ac61fc6
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
9d375a4c24c4549359efd23b3266441c05d0a4fd1f3d4070d8702b05bf45cdac
MD5 hash:
33aae5bc85340deda2e99aac8d530988
SHA1 hash:
5c38eaacaaa4875773970583bbce983eec023e3a
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
91516fce462fc6f83967568ac78e82023b2ced5d242ac284858fbab44fd238f9
MD5 hash:
dbf9a12daf7c38e7fa90d3499b87af6d
SHA1 hash:
9a90bbd151d0531def52e4ecb29b23f9aa123f5a
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
4ff4131414d1ad23d3979cee0b058244355c38437e3de14ae3d37de097a460ac
MD5 hash:
e94354183099d8a34a2a25b7e17a6958
SHA1 hash:
5372625a1429f9cdd9a204d46d32936d5ec98410
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
336ffef9f2341bee6ac4e5120aa021de952236afae867f4b6277145b8ecee7a0
MD5 hash:
6c8de69f87ae0ddff6fd317724e3a430
SHA1 hash:
aee09619e9858d9994593dac190c75c85db97947
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
31ee0712cf8816d747f96b893616a3150c09b243323a320b7a74591889968033
MD5 hash:
1891fa34e9b521f4b078b20913c56ace
SHA1 hash:
83180c4764726203b0d5dc83cea37d4a200d370f
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
304ebc640c0bcddcd6319368050b86acbaea535872b1d701ad5731adbe243f12
MD5 hash:
5991f8d811be2db04825075df8e5b996
SHA1 hash:
11625b8b7bde21c9732d1b7e21cca8e57e342b61
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
1c0c12f12670dbcc0a9b911fb393276866aacf6abeee02c17779970d9e977876
MD5 hash:
fb30f7d96e0cde3ead07501a88ade00d
SHA1 hash:
974f1e22d3cc04026faa40fc0e6f1aa826fb1981
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
130a824105631ba3f09670f62c53ba5702b83121612f89682b1281227b5835da
MD5 hash:
8d1ca1d355a11614b6a80cb9a3ce6311
SHA1 hash:
671dfe889b1db01c031310ab789edbfb16fcf075
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
12ac6669fd24b78967f796e71abac2f82f45487f2e155dbd4928a3ef928f8a0b
MD5 hash:
947fd26e27feec8876cf6e38a2203082
SHA1 hash:
143bc97452ff40bbb8f0a85db984ee57a5fd4333
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
0900a2aa3c77192563c6d605531872eefaab0a9607a7509fcba22996638532a9
MD5 hash:
bf6f68259d8d5944a4a52a4f179848d7
SHA1 hash:
9e563e1864e84c0353b961a40b0ce03de9d4efc2
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
04b748e6720f2321b967690f492787e956c78c492906eed9b57dc084b574a25a
MD5 hash:
3757cd4217b9f38f450260b99563292f
SHA1 hash:
091aa30e0fdd14dd07b8bb28ac68751618cc49a3
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
SH256 hash:
79b602eb2703918564bbfa01cded77f8e8308adbeec88a6709d2d78f7509a9a9
MD5 hash:
c9c98456e3540cb3dc80ef41a3c6e4e8
SHA1 hash:
bcc57bd87f1a1092dc940f3605924e5f1cd72495
Link:
https://www.unpac.me/results/298066cb-6f41-475f-a589-34d847d04ddf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/79b602eb2703918564bbfa01cded77f8e8308adbeec88a6709d2d78f7509a9a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/474569/

Comments