MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 800b4455105a08833332092017909f9dd47bd4ebfb1cbddbe0b95658d03b8d64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mallox


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 800b4455105a08833332092017909f9dd47bd4ebfb1cbddbe0b95658d03b8d64
SHA3-384 hash: 68d6265d1a87b086cf2323e72d90f14353f876e8498ccc00e7c6bf61beb489b7639da02ba8696e11e9329eca4484fe53
SHA1 hash: cf7f1085978128cc082aec921d34d6d25e4ab19b
MD5 hash: b2993b2a7a1edba14742564de7e85cb2
humanhash: hawaii-pasta-bakerloo-golf
File name:ConsoleApp7.exe
Download: download sample
Signature Mallox
Create hunting rule
File size:54'272 bytes
First seen:2021-12-31 08:31:01 UTC
Last seen:2021-12-31 11:19:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 768:9ULV4TaW98YQuGwpWlsHF3mqjIAxyLVGEQW:9mJuDQ+MlsHF/sTVXF
Threatray 1'376 similar samples on MalwareBazaar
TLSH T18F334B15AFBCD881D4A402F1F8D3D9F805A4ED11D42ADA3BE9E53E0A3937346690A7C7
File icon (PE):PE icon
dhash icon c9ac6a78e460f2f0 (1 x Mallox, 1 x RemcosRAT)
Reporter fbgwls245
Tags:exe Mallox Ransomware

Intelligence

File Origin
# of uploads :
2
# of downloads :
440
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ConsoleApp7.exe
Verdict:
Suspicious activity
Analysis date:
2021-12-31 08:32:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/176f1b66-5d4e-4568-992b-3f97c46b315d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/216905/
Detection(s):
SecuriteInfo.com.Variant.Bulz.834529.32722.18027.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Sending an HTTP GET request
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching a service
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61cebfc8ec6c6c14a9fffbe7/reports/f539ea01-54b8-4fd3-88d8-02fd2f57a5a1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4dbc9c7d-bfd2-4b78-8fda-07a19cb8ef44
Result
Threat name:
Targeted Ransomware
Create hunting rule
Detection:
malicious
Classification:
rans.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/914264
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for URL or domain
Creates files in the recycle bin to hide itself
Deletes shadow drive data (may be related to ransomware)
Injects a PE file into a foreign processes
Machine Learning detection for sample
May disable shadow drive data (uses vssadmin)
Multi AV Scanner detection for submitted file
Opens network shares
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Modification of Boot Configuration
Sigma detected: Powershell Used To Disable Windows Defender AV Security Monitoring
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to open files direct via NTFS file id
Uses bcdedit to modify the Windows boot settings
Writes to foreign memory regions
Yara detected Targeted Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 546742 Sample: ConsoleApp7.exe Startdate: 31/12/2021 Architecture: WINDOWS Score: 100 71 Antivirus detection for URL or domain 2->71 73 Multi AV Scanner detection for submitted file 2->73 75 Yara detected Targeted Ransomware 2->75 77 11 other signatures 2->77 8 ConsoleApp7.exe 18 8 2->8         started        process3 dnsIp4 65 91.243.44.22, 49730, 80 SHOCK-1US Russian Federation 8->65 55 C:\Users\user\AppData\Local\Temp\RegAsm.exe, PE32 8->55 dropped 57 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 8->57 dropped 59 C:\Users\user\...\Unctnmnxidkfrmahbwqxhbt.vbs, ASCII 8->59 dropped 61 C:\Users\user\AppData\...\ConsoleApp7.exe.log, ASCII 8->61 dropped 81 Writes to foreign memory regions 8->81 83 Allocates memory in foreign processes 8->83 85 Injects a PE file into a foreign processes 8->85 13 RegAsm.exe 43 8->13         started        18 wscript.exe 1 8->18         started        20 AdvancedRun.exe 1 8->20         started        22 AdvancedRun.exe 1 8->22         started        file5 signatures6 process7 dnsIp8 67 192.168.2.2 unknown unknown 13->67 63 C:\$Recycle.Bin\RECOVERY INFORMATION.txt, ASCII 13->63 dropped 87 May disable shadow drive data (uses vssadmin) 13->87 89 Creates files in the recycle bin to hide itself 13->89 91 Deletes shadow drive data (may be related to ransomware) 13->91 93 3 other signatures 13->93 24 cmd.exe 13->24         started        27 cmd.exe 13->27         started        29 vssadmin.exe 13->29         started        31 cmd.exe 18->31         started        69 192.168.2.1, 135, 274, 49787 unknown unknown 20->69 33 AdvancedRun.exe 20->33         started        35 AdvancedRun.exe 22->35         started        file9 signatures10 process11 signatures12 79 Uses bcdedit to modify the Windows boot settings 24->79 37 conhost.exe 24->37         started        39 bcdedit.exe 24->39         started        41 conhost.exe 27->41         started        43 bcdedit.exe 27->43         started        45 conhost.exe 29->45         started        47 conhost.exe 31->47         started        49 reg.exe 31->49         started        51 takeown.exe 31->51         started        53 26 other processes 31->53 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/800b4455105a08833332092017909f9dd47bd4ebfb1cbddbe0b95658d03b8d64/
Threat name:
ByteCode-MSIL.Trojan.Seraph
Create hunting rule
Status:
Malicious
First seen:
2021-12-30 23:09:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
29704c1c8f22aefdd760c85d19b71aa22fd35e0506804d629c92611f3df072bc
Mallox
30c2c6ab4ddd7c5bcd0da13b6b6d7dff544bfb369f6c8a0c3825e54a8852059c
Mallox
695722bddb32724a102d8d12aca0ebc841c4944f52632c3ea595941a6e988759
Mallox
6ff685e5acfd946101b558f9f9d47a0d515c62e7476f5f83694609d64343315e
Mallox
84a5f6bd4a13a1926ab7e242b88c8956857be6bc2a4c2d4faa27949c3b3483db
Mallox
875ddce13022bafdf9e27f3eab2af78147c589037bf9c86192091e3843cedb16
Mallox
90903999baa70b0965698675e67612c0d16ef890394fa822cc11b8b7af8f7ee5
Mallox
d2d45c33e2a117592e32cc56193c281dcb331281f6024a2eb793c756b4a45d89
Mallox
fb866525850ae54290c45e8b03924e453052c5e1f0261467ff2ff35fa8ae7f9d
Mallox
fd1d2de482925060b31bf7aed80909ff2c8f4a5bfa61f8679e70d5670e9bb67e
Mallox
+ 1'366 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery evasion ransomware
Link:
https://tria.ge/reports/211231-keqg6sggb4/
Behaviour
Discovers systems in the same network
Interacts with shadow copies
Kills process with taskkill
Modifies registry class
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Launches sc.exe
Suspicious use of SetThreadContext
Enumerates connected drives
Loads dropped DLL
Modifies file permissions
Executes dropped EXE
Modifies extensions of user files
Modifies service settings
Stops running service(s)
Deletes shadow copies
Modifies boot configuration data using bcdedit
Nirsoft
Unpacked files
SH256 hash:
800b4455105a08833332092017909f9dd47bd4ebfb1cbddbe0b95658d03b8d64
MD5 hash:
b2993b2a7a1edba14742564de7e85cb2
SHA1 hash:
cf7f1085978128cc082aec921d34d6d25e4ab19b
Link:
https://www.unpac.me/results/6a2696fc-f11d-400f-9ec2-bc1a0378eefd/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/800b4455105a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/800b4455105a08833332092017909f9dd47bd4ebfb1cbddbe0b95658d03b8d64

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mallox

Executable exe 800b4455105a08833332092017909f9dd47bd4ebfb1cbddbe0b95658d03b8d64

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/216905/
  
URLhaus
https://urlhaus.abuse.ch/url/1938363/
  
Delivery method
Distributed via web download

Comments