MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c94921315ca053d50da719c757797a1f32593915a430d0c397011db81f61fd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 6 File information Comments

SHA256 hash:	7c94921315ca053d50da719c757797a1f32593915a430d0c397011db81f61fd9
SHA3-384 hash:	c969d2071a322d62db84657cd32fbe0b2d6bbf352c379bb2714f56b4f4599d54da4cac5a310543be69172f7a996a0d34
SHA1 hash:	8879154a4bf376df6de42cc803eeba7f4ba5d26d
MD5 hash:	9f666b098779057e585df242f0043bf7
humanhash:	missouri-georgia-social-delta
File name:	7c94921315ca053d50da719c757797a1f32593915a430d0c397011db81f61fd9.tgz
Download:	download sample
File size:	577'514 bytes
First seen:	2024-12-12 11:20:10 UTC
Last seen:	Never
File type:	gz
MIME type:	application/gzip
ssdeep	6144:f+51HMCtf2gvlt1TNINTFW5D4aIdKEqKboEF2p7flO:esCIgvj1yNTFW94aId/do7p0
TLSH	T12BC423D46BA0FE6CF4449BFCCB9ACD41EF1DB486AD110497D84863B9E2133325B8B261
Magika	gzip
Reporter	cybermvaks
Tags:	file-pumped gz Santander

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Kopia płatności_Santander_TF1903218545300000564290004.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	262'144'000 bytes
SHA256 hash:	9a47d281a3de28da9e0e1306439b2b966f6c21040a8febd99a8ff0d925c7c361
MD5 hash:	aa24da375e50f1c1c80c3f3452fd1870
De-pumped file size:	988'160 bytes (Vs. original size of 262'144'000 bytes)
De-pumped SHA256 hash:	a8b731e64d082fe12c422b241324bf8d15c1322f0a6b51f3eb247eab4b95d57f
De-pumped MD5 hash:	0fa6d48b265cd7fa6ac66900ddb61081
MIME type:	application/x-dosexec

Vendor Threat Intelligence

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=675ac91f4bc1eb3cc1ee9d93

Tags:

virus msil

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

large-file obfuscated overlay packed packer_detected

Link:

https://www.filescan.io/uploads/675ac732e2b28ac5ea1475c7/reports/504d2580-a9bb-423c-ad8b-c75a72c3054a/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7c94921315ca053d50da719c757797a1f32593915a430d0c397011db81f61fd9

Result

Verdict:

MALICIOUS

Score:

99%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

10/10

Tags:

discovery

Link:

https://tria.ge/reports/241212-pxm7zstrhw/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Suspicious use of NtCreateUserProcessOtherParentProcess

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7c94921315ca053d50da719c757797a1f32593915a430d0c397011db81f61fd9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)