MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e3c29f65636212adf864d41327d17ca89ac0f0ef1ad6135ab32ca8dfea8609a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e3c29f65636212adf864d41327d17ca89ac0f0ef1ad6135ab32ca8dfea8609a
SHA3-384 hash: 7581f7082d053b3cd4dbcdb9bdf82c3219f65d66e1b74882fb5c66e9eb1cf2d8e106830790af90f9d2ead44f6c2f1b0f
SHA1 hash: 58be04ffe095f242e9680e838930149485fd68d9
MD5 hash: 1f3eaa8c1210d2cd71e3335c5bcf4890
humanhash: winner-sink-connecticut-king
File name:1f3eaa8c1210d2cd71e3335c5bcf4890
Download: download sample
File size:6'433'220 bytes
First seen:2024-10-18 07:42:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 72c4e339b7af8ab1ed2eb3821c98713a (48 x BlankGrabber, 26 x PythonStealer, 7 x LunaStealer)
ssdeep 196608:Qug2qUzCsXDjDyfndJolpPgToa10/OFOnJzDdUOb:a2qaCEDAJ83a10WsZd7
TLSH T12356338456D11DAAFC77A13E89618952DAB278B60771C79F06B402273E336A4D93EF03
TrID 70.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.9% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.5% (.ICL) Windows Icons Library (generic) (2059/9)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter zbetcheckin
Tags:64 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
396
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1f3eaa8c1210d2cd71e3335c5bcf4890
Verdict:
Malicious activity
Analysis date:
2024-10-18 08:14:50 UTC
Tags:
evasion pyinstaller python
Link:
https://app.any.run/tasks/8c37e74e-7639-4d21-9353-afd0f3bd1f6e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win64.Evo-gen.14957.29019.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6712119ae706a56b5a02ad7c
Tags:
Powershell Vmdetect
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
expand lolbin microsoft_visual_cc overlay packed
Link:
https://www.filescan.io/uploads/671211937f0507a8d241c948/reports/0775bf73-b850-4b3c-b5bb-9e3fa72d87a5/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/7e3c29f65636212adf864d41327d17ca89ac0f0ef1ad6135ab32ca8dfea8609a
Result
Verdict:
MALICIOUS
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/089e903c-5cc9-4fec-944f-82880c8b822f
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1536848
Signature
AI detected suspicious sample
Checks for kernel debuggers (COM1)
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Sigma detected: Potentially Suspicious Malware Callback Communication
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1536848 Sample: NszzrGz7Vp.exe Startdate: 18/10/2024 Architecture: WINDOWS Score: 64 90 systemupdate.ddnsgratis.com.br 2->90 92 ipinfo.io 2->92 94 api.ipify.org 2->94 104 Multi AV Scanner detection for submitted file 2->104 106 Sigma detected: Potentially Suspicious Malware Callback Communication 2->106 108 AI detected suspicious sample 2->108 12 NszzrGz7Vp.exe 30 2->12         started        16 OneDriveUpdate.exe 30 2->16         started        18 OneDriveUpdate.exe 30 2->18         started        20 OneDriveUpdate.exe 2->20         started        signatures3 process4 file5 72 C:\Users\user\AppData\Local\...\win32wnet.pyd, PE32+ 12->72 dropped 74 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 12->74 dropped 82 19 other files (none is malicious) 12->82 dropped 114 Potentially malicious time measurement code found 12->114 22 NszzrGz7Vp.exe 2 12->22         started        76 C:\Users\user\AppData\Local\...\win32wnet.pyd, PE32+ 16->76 dropped 78 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 16->78 dropped 80 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 16->80 dropped 84 18 other files (none is malicious) 16->84 dropped 25 OneDriveUpdate.exe 1 16->25         started        86 21 other files (none is malicious) 18->86 dropped 29 OneDriveUpdate.exe 18->29         started        88 21 other files (none is malicious) 20->88 dropped 31 OneDriveUpdate.exe 20->31         started        signatures6 process7 dnsIp8 62 C:\Users\user\AppData\...\OneDriveUpdate.exe, PE32+ 22->62 dropped 33 cmd.exe 1 22->33         started        102 104.26.12.205, 443, 49742, 49746 CLOUDFLARENETUS United States 25->102 112 Checks for kernel debuggers (COM1) 25->112 35 cmd.exe 25->35         started        37 cmd.exe 29->37         started        39 cmd.exe 31->39         started        file9 signatures10 process11 process12 41 OneDriveUpdate.exe 30 33->41         started        44 taskkill.exe 1 33->44         started        46 conhost.exe 33->46         started        48 conhost.exe 35->48         started        50 conhost.exe 37->50         started        52 conhost.exe 39->52         started        file13 64 C:\Users\user\AppData\Local\...\win32wnet.pyd, PE32+ 41->64 dropped 66 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 41->66 dropped 68 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 41->68 dropped 70 18 other files (none is malicious) 41->70 dropped 54 OneDriveUpdate.exe 1 1 41->54         started        process14 dnsIp15 96 systemupdate.ddnsgratis.com.br 194.5.152.215, 49734, 49744, 49748 DEDIPATH-LLCUS Germany 54->96 98 ipinfo.io 34.117.59.81, 443, 49733, 49743 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 54->98 100 api.ipify.org 104.26.13.205, 443, 49732 CLOUDFLARENETUS United States 54->100 110 Checks for kernel debuggers (COM1) 54->110 58 cmd.exe 1 54->58         started        signatures16 process17 process18 60 conhost.exe 58->60         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7e3c29f65636212adf864d41327d17ca89ac0f0ef1ad6135ab32ca8dfea8609a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7e3c29f65636212adf864d41327d17ca89ac0f0ef1ad6135ab32ca8dfea8609a/
Threat name:
Win64.Trojan.Nekark
Create hunting rule
Status:
Malicious
First seen:
2024-10-18 07:43:11 UTC
File Type:
PE+ (Exe)
Extracted files:
712
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=py6ct5swgyqsvx4gjvate7ixzke2ydyo6gwwcnnlglfi37vimcna._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence pyinstaller
Link:
https://tria.ge/reports/241018-jk6kxaxgqn/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Detects Pyinstaller
Adds Run key to start application
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/07ced678-1424-44c8-b4f4-80f7033e676b
Unpacked files
SH256 hash:
7e3c29f65636212adf864d41327d17ca89ac0f0ef1ad6135ab32ca8dfea8609a
MD5 hash:
1f3eaa8c1210d2cd71e3335c5bcf4890
SHA1 hash:
58be04ffe095f242e9680e838930149485fd68d9
Link:
https://www.unpac.me/results/29c2af7c-6128-459d-bad7-26a7deef8f92/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7e3c29f65636212adf864d41327d17ca89ac0f0ef1ad6135ab32ca8dfea8609a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 7e3c29f65636212adf864d41327d17ca89ac0f0ef1ad6135ab32ca8dfea8609a

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3240631/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (FORCE_INTEGRITY)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::ConvertSidToStringSidW
ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::GetTokenInformation
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineW
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::FindFirstFileW
KERNEL32.dll::RemoveDirectoryW
KERNEL32.dll::SetDllDirectoryW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments


Avatar
zbet commented on 2024-10-18 07:42:59 UTC

url : hxxp://n.ddnsgratis.com.br/sitef/sitef64/client15.exe