MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PlagueBot


Vendor detections: 14


Intelligence 14 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961
SHA3-384 hash: 23b976a01cb17ee96c78c4f86f3036ae96d99f857422ff07b703228ff112cd2f0041995c49a717340d51f75cc2bfe8ea
SHA1 hash: 1911a59e8c4b427d3fbc8fc9c794886bd2d81305
MD5 hash: b03ccade490854df220914c4430967e2
humanhash: cup-carbon-island-fix
File name:b03ccade490854df220914c4430967e2.exe
Download: download sample
Signature PlagueBot
Create hunting rule
File size:990'208 bytes
First seen:2022-10-19 06:01:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 05170847fd36bdfb6ba500b52de3a324 (1 x PlagueBot)
ssdeep 24576:xNxsglIPAtgV+rnEQBg2AdqgwGd9OCPltP0gxkR3dCqJO5VxQ75Sf1:57uKrnEQi2Ad/wQPLP0gx1qt5Sf1
Threatray 18 similar samples on MalwareBazaar
TLSH T15B254A51F342C12BC4627AB48E4DE2E206B5F6281D36E8DF31CB0B6D2E749515F3AA47
TrID 35.0% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
26.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
11.0% (.SCR) Windows screen saver (13101/52/3)
8.8% (.EXE) Win64 Executable (generic) (10523/12/4)
5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Reporter abuse_ch
Tags:exe PlagueBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
227
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b03ccade490854df220914c4430967e2.exe
Verdict:
Malicious activity
Analysis date:
2022-10-19 06:36:45 UTC
Tags:
trojan
Link:
https://app.any.run/tasks/ee2239c1-c2f6-40ac-9c4e-e92d2ab7bf2f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/321597/
Detection(s):
Win.Malware.Titirez-9866519-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Moving a file to the %AppData% subdirectory
Enabling the 'hidden' option for recently created files
Сreating synchronization primitives
Creating a process from a recently created file
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/43767/overview
Behaviour
MalwareBazaar
CPUID_Instruction
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm explorer.exe greyware shell32.dll
Link:
https://www.filescan.io/uploads/634f92ddb5f60e72b8c778a5/reports/4149c2b5-56bb-473e-92d5-2765f8aba9a6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Sofacy
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c7fdf23f-6a94-4399-8c59-8c2fa43ce8fc
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1093232
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected PersistenceViaHiddenTask
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2022-10-01 15:50:47 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
22 of 25 (88.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qhfr7i2qoie7gybgdz4vzrugelcbmpf3brqifxd5qnmkares7fqq._file
Verdict:
malicious
Similar samples:
01d96676851421e591657a6114eee8b52a123ae66585edd8870cb5b949626ddc
PlagueBot
06e145e0068c9631d558c1f1c04b51fe8c6a36052a6a051986642eb0dec85232
PlagueBot
75da456980b6c16a80a05269d6fee93bc18a242ebe0c7f9f014bad8828b09291
PlagueBot
8c41074da2e38da01c61a00a6fb9a9983d5e6091547b4f7a5f74b3797a5a59fe
PlagueBot
9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f
PlagueBot
adc5787d9d531b5a1159b4b14c67fd881e9bf89c97ae27dd2d5e34dbf992d97c
PlagueBot
bb39c0c70183c13923ea4b4eedce081c40d7175e812de1e370ffcc3237fcbe75
PlagueBot
eca147888bcb1a2706cacd5743c914d5c62dcb76b03a6b29625eeba17f6e78aa
PlagueBot
+ 8 additional samples on MalwareBazaar
Result
Malware family:
plaguebot
Create hunting rule
Score:
  10/10
Tags:
family:plaguebot botnet persistence
Link:
https://tria.ge/reports/221019-grf8gseha3/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Drops startup file
Loads dropped DLL
Executes dropped EXE
PlagueBot Executable
PlagueBot
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f63c0989-ed03-4f28-80dc-cb50931d0e1a
Unpacked files
SH256 hash:
81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961
MD5 hash:
b03ccade490854df220914c4430967e2
SHA1 hash:
1911a59e8c4b427d3fbc8fc9c794886bd2d81305
Link:
https://www.unpac.me/results/90341c84-a49f-434c-9a4b-71a009d72a24/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PlagueBot

Executable exe 81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2378007/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/321597/

Comments