MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7de9370315875ab6b3ff0812f7e182e6f49f96c959c461c3e0defda61bfbc59a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7de9370315875ab6b3ff0812f7e182e6f49f96c959c461c3e0defda61bfbc59a
SHA3-384 hash: d59be51100db3d4a71f044a4519b951029845ccd391ed54b3630819bd108a186c32e436465a98e9de88b84a3b8f431f0
SHA1 hash: 7838c480c0670159255c08f923bd76bc75e65fca
MD5 hash: 8bf1b57efab2882a70ea2dae74663373
humanhash: thirteen-ceiling-asparagus-ten
File name:7DE9370315875AB6B3FF0812F7E182E6F49F96C959C461C3E0DEFDA61BFBC59A.dll
Download: download sample
File size:225'280 bytes
First seen:2022-05-17 14:43:26 UTC
Last seen:2022-05-17 15:47:44 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 1f6313f63015da51a2099dfab83e55ef
ssdeep 3072:N0tQ2kmxzBhraLXWAwAFLWwY+/tp0sbqyDb09+gWZ4z:GJXrarWAwAFLWwF/tpHbqs0y4z
Threatray 2 similar samples on MalwareBazaar
TLSH T1FA242921B600C831F78617315965FAE549686D3913A5E9CFF3B83E7A29702C35A3B24F
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10523/12/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 818da080a0a0a0a2 (137 x Heodo, 46 x Urelas, 29 x ValleyRAT)
Reporter obfusor
Tags:dll Farfli RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
284
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/271666/
Detection(s):
SecuriteInfo.com.DLOADER.Trojan.14272.25870.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/ce35e451-0e34-421e-8eca-b47037d79702
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/995934
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 628432 Sample: CLSmoHXN7Z.dll Startdate: 17/05/2022 Architecture: WINDOWS Score: 52 29 Multi AV Scanner detection for submitted file 2->29 31 Machine Learning detection for sample 2->31 9 loaddll32.exe 1 2->9         started        process3 process4 11 cmd.exe 1 9->11         started        13 rundll32.exe 9->13         started        15 WerFault.exe 9 9->15         started        process5 17 rundll32.exe 11->17         started        19 WerFault.exe 20 9 13->19         started        21 WerFault.exe 3 9 13->21         started        process6 23 WerFault.exe 2 9 17->23         started        25 WerFault.exe 9 17->25         started        process7 27 conhost.exe 23->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7de9370315875ab6b3ff0812f7e182e6f49f96c959c461c3e0defda61bfbc59a/
Threat name:
Win32.Backdoor.Farfli
Create hunting rule
Status:
Malicious
First seen:
2022-05-17 14:44:06 UTC
File Type:
PE (Dll)
Extracted files:
32
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
18b1f8b31be408c4f163338258d9fe7b81083a7cde874d3a49fa14f9ed271a5f
ea689a87e8b9b2de3089a154c60c1bc85e4a69837463e044d23014934c4c5eff
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220517-r35ekadeb5/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
7de9370315875ab6b3ff0812f7e182e6f49f96c959c461c3e0defda61bfbc59a
MD5 hash:
8bf1b57efab2882a70ea2dae74663373
SHA1 hash:
7838c480c0670159255c08f923bd76bc75e65fca
Link:
https://www.unpac.me/results/f9d123ee-11e1-459c-ad9e-738d3f10b475/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7de9370315875ab6b3ff0812f7e182e6f49f96c959c461c3e0defda61bfbc59a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess
Create hunting rule
Author:ditekSHen
Description:Detects executables calling ClearMyTracksByProcess

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/271666/

Comments