MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ddc71a84d02c35047853e73a120a4216e51debe73146d1f62a35bb05ac53dd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ddc71a84d02c35047853e73a120a4216e51debe73146d1f62a35bb05ac53dd8
SHA3-384 hash: 9b12c31416d61ceb0db27c71511dfefb265e636c374384fbc9da01ae6c1f30ed065ca7f83ad22f2dbebae66b94b7dfc5
SHA1 hash: b55c778714dea238340f3d5e009a36655419097f
MD5 hash: a62ad2ed0d68cf5424757edbb12529f9
humanhash: one-minnesota-florida-friend
File name:SecuriteInfo.com.Trojan.DownLoader44.45171.7235.10198
Download: download sample
File size:2'962'944 bytes
First seen:2022-04-22 09:48:57 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 1da9c1d644e2b4c3e552350a191f516f
ssdeep 49152:P0u8EF2nTjpYSERv+YDH531s0OeG1HiTx9:MFn45qHe
Threatray 69 similar samples on MalwareBazaar
TLSH T13AD55B23F244B63EC56F1A3A5537A2549D3FB76165229C5B1BF48C8C8F364812B3E60B
TrID 59.6% (.EXE) Inno Setup installer (109740/4/30)
22.5% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
5.7% (.EXE) Win64 Executable (generic) (10523/12/4)
3.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
2.4% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/265704/
Detection(s):
PUA.Win.Packer.Exe-6
Create hunting rule

SecuriteInfo.com.Trojan.DownLoader44.45171.7235.10198.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe expand.exe keylogger pos replace.exe update.exe
Link:
https://www.filescan.io/uploads/62627b2dc7f6e2c5442cfc62/reports/eeba47a4-b3c5-4e2c-b583-5c75d44f3320/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9d9ddba5-e82c-4138-8ce6-29e00c9efc3f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/981245
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 613732 Sample: SecuriteInfo.com.Trojan.Dow... Startdate: 22/04/2022 Architecture: WINDOWS Score: 60 28 Antivirus / Scanner detection for submitted sample 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Sigma detected: Suspicious Call by Ordinal 2->32 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 rundll32.exe 8->12         started        14 rundll32.exe 8->14         started        16 6 other processes 8->16 process5 18 rundll32.exe 10->18         started        20 WerFault.exe 9 12->20         started        22 WerFault.exe 2 9 14->22         started        24 WerFault.exe 9 16->24         started        process6 26 WerFault.exe 23 9 18->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ddc71a84d02c35047853e73a120a4216e51debe73146d1f62a35bb05ac53dd8/
Threat name:
Win32.Trojan.Grandoreiro
Create hunting rule
Status:
Malicious
First seen:
2022-03-13 04:17:18 UTC
File Type:
PE (Dll)
Extracted files:
15
AV detection:
22 of 33 (66.67%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
04fc7f2892ab44468c804e97ddb88ecdd1d7ec36a212a22f019d91a8e2830a74
1cce084dfad9033bf86425313b45b5eb3920123fc2f8c332f0c2f4506cd948b1
303192a108bc345fefe389bcbfb9e5d8e461840640895e1c9bd520ed58f33b99
3fcdfbab84ee1f633f5bf3dbf71b3d0e067ef2eacd980b1262ddbd754a7bb7bf
4cfd6610098cc0c5310a0b9d43fc62424f2ea7733f97200bf3bac5bad30ac668
84ccdb3f44e540fb824817dfd654979468b71f3c632ff46852a6b9602a84576b
ba81b3e4b29438888dcbb4f1cdfea11586de209723cb80c2756434225e43a92f
d5de7832e47a9120155d6696781dbc8d04c1acca799872aebf05750a73ffbf95
ecb89ecfec76265c7ee91f1b9f02549ea17042fe9a11498413c92be2cf207e03
f5b21463a182d5debd6033dffed7722e261516b5b0e86dc629b8fc8a487bcdff
+ 59 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220422-ltmv9sbgb8/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
c4fa41c4fe013f24c9c45ad82ff3559e8b5ab6e66d47ae1d7a7e9021cbfda74e
MD5 hash:
e69c83f0cc146f44658196f819f422a1
SHA1 hash:
d89035604344a4af6ffdf374657ab34b96e38c35
Link:
https://www.unpac.me/results/8b3562f4-0bbe-4ac9-86a7-c8f061bbfd53/
SH256 hash:
7ddc71a84d02c35047853e73a120a4216e51debe73146d1f62a35bb05ac53dd8
MD5 hash:
a62ad2ed0d68cf5424757edbb12529f9
SHA1 hash:
b55c778714dea238340f3d5e009a36655419097f
Link:
https://www.unpac.me/results/8b3562f4-0bbe-4ac9-86a7-c8f061bbfd53/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7ddc71a84d02c35047853e73a120a4216e51debe73146d1f62a35bb05ac53dd8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/265704/

Comments