MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 818f62189c2eb790718f547dab81018ead3a70064bb891fb54667f0a2e474910. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 818f62189c2eb790718f547dab81018ead3a70064bb891fb54667f0a2e474910
SHA3-384 hash: 5cbc2cb559e0296fa04e3898b4145a9e1704020b28c464d08a791025b594364668051c1a997319dbc80295f46f0de8dc
SHA1 hash: c6af8fdaa3d8bfc417251d4774a445f9950509ff
MD5 hash: e75ad8ea02a3e1dd1c33593394eee750
humanhash: triple-king-leopard-lemon
File name:Supplier Lists Requirement.exe
Download: download sample
File size:1'538'048 bytes
First seen:2023-03-27 09:50:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bbac62fd99326ea68ec5a33b36925dd1 (46 x AgentTesla, 38 x njrat, 27 x Formbook)
ssdeep 24576:Q4lavt0LkLL9IMixoEgear/AFCVrUTvbjN7bJs4ORHnEBpq9MmCS:Hkwkn9IMHeasUrUTbJFORHEPaPCS
Threatray 1'258 similar samples on MalwareBazaar
TLSH T15665BE4267898251C3B35173BB51A7627E6B3C253661B4BA2FB83D3FB570C53831A623
TrID 85.7% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
4.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
2.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b0b0b2b4e2988c96 (7 x Loda, 2 x njrat, 1 x LodaRAT)
Reporter 0xToxin
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
236
Origin country :
IL IL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Supplier Lists Requirement.exe
Verdict:
No threats detected
Analysis date:
2023-03-27 09:51:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d626f0f1-2f2b-459a-9a01-97d9a1be2ce0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/377809/
Detection(s):
Txt.Malware.LodaRAT-9769386-0
Create hunting rule

SecuriteInfo.com.VBS.Dropper-4.UNOFFICIAL
Create hunting rule

Txt.Malware.LodaRAT-9978072-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/75165/overview
Behaviour
MalwareBazaar
CheckNumberOfProcessor
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit greyware keylogger packed shell32.dll
Link:
https://www.filescan.io/uploads/64216708009023b71dc30bde/reports/2cdb4cf5-3bd3-4fe2-a665-763745ea456e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/818f62189c2eb790718f547dab81018ead3a70064bb891fb54667f0a2e474910
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b12759c2-5ad8-4fa0-8b7c-a86e525d5884
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1202551
Signature
Multi AV Scanner detection for submitted file
Uses Windows timers to delay execution
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/818f62189c2eb790718f547dab81018ead3a70064bb891fb54667f0a2e474910/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-03-27 09:51:09 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qghwege4f23za4mpkr62xaibr2wtu4agjo4jd62umz7qulshjeia._file
Verdict:
malicious
Similar samples:
16475b2dabce04660e1f6127adf54827b7cf024f4cded92b9be6e07c85ae7a89
22c729d8f90b69b76d5a3f5f2dce8c149ff62d25f2b6d8d60a9557d4b0ebdc07
2551a571a99fb4d75cdcb33388ee46757767d949fb098658e38144f77733db97
2c916a10a631eaf7666091451c1b618a4bc6e2c159306d9723b6f0ab54e579fe
3888e180beb35b0ebef5b78b77e27f47879ea46b32adee17e65278d3d3a7fe47
74b86bc238ebe4299858163c95541dd07cec75a2960b74fdb78940c9aee38864
78973c8f956a77c6c88aa4b508ce289d2c59966e1e7f2af4fc9cfd9e2368df66
98d1a1ed8da6588112a805e5864e7ff29031d5bf9db49486a63fc7d652e66f8e
+ 1'248 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230327-lvg2eaeh31/
Behaviour
Enumerates physical storage devices
Unpacked files
SH256 hash:
818f62189c2eb790718f547dab81018ead3a70064bb891fb54667f0a2e474910
MD5 hash:
e75ad8ea02a3e1dd1c33593394eee750
SHA1 hash:
c6af8fdaa3d8bfc417251d4774a445f9950509ff
Link:
https://www.unpac.me/results/9f5b74a6-bf76-4b5e-9332-c9fc76f24328/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/818f62189c2eb790718f547dab81018ead3a70064bb891fb54667f0a2e474910

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/377809/

Comments