MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7c4953b9bdb0f239ffa46c9104258eaba8a36b6156f3a9890e08d81bc2cacacc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | 7c4953b9bdb0f239ffa46c9104258eaba8a36b6156f3a9890e08d81bc2cacacc |
|---|---|
| SHA3-384 hash: | 558031c4290c3e10866eca50cc13ea6a175b4afe7fbdf4ce526bcccc2ef03eb98dd3634eba6472976b092bfe59f10716 |
| SHA1 hash: | 5edd38330eedce237fe9a53751fe1012db534218 |
| MD5 hash: | 4286dc39760eca96dfddfba5d7231bde |
| humanhash: | bluebird-ohio-mars-snake |
| File name: | bere3.dll |
| Download: | download sample |
| File size: | 2'555'392 bytes |
| First seen: | 2022-04-19 10:49:02 UTC |
| Last seen: | 2022-04-20 10:21:25 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 2310f9a838371220cf65a7f668b2a0e6 |
| ssdeep | 49152:6sFqGOf5xlR+f195tkEkJtEQKbSj1Nfg9kQ2WbApFCqKyR:VqGOf53Uf5xkbEQCSj16k9WbARK+ |
| Threatray | 2'065 similar samples on MalwareBazaar |
| TLSH | T1BEC51262E3DFD649F811B6368798E81FC88E68079C638166ED8FCB4A4424611CEFC5F5 |
| TrID | 45.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.3% (.EXE) OS/2 Executable (generic) (2029/13) 18.0% (.EXE) Generic Win/DOS Executable (2002/3) 18.0% (.EXE) DOS Executable Generic (2000/1) |
| Reporter | Anonymous |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Verdict:
No Threat
Threat level:
2/10
Confidence:
100%
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Signature
Contain functionality to detect virtual machines
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Searches for specific processes (likely to inject)
Sigma detected: Suspicious Call by Ordinal
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Threat name:
Win64.Trojan.Bumbleloader
Status:
Malicious
First seen:
2022-04-18 21:05:29 UTC
File Type:
PE+ (Dll)
AV detection:
17 of 38 (44.74%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 2'055 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
9/10
Tags:
evasion
Behaviour
Suspicious behavior: EnumeratesProcesses
Checks BIOS information in registry
Identifies Wine through registry keys
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Unpacked files
SH256 hash:
7c4953b9bdb0f239ffa46c9104258eaba8a36b6156f3a9890e08d81bc2cacacc
MD5 hash:
4286dc39760eca96dfddfba5d7231bde
SHA1 hash:
5edd38330eedce237fe9a53751fe1012db534218
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 7c4953b9bdb0f239ffa46c9104258eaba8a36b6156f3a9890e08d81bc2cacacc
(this sample)
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.