MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8265a48b18b9fca04653fdf9000ce8bf9271e85ea9bf1f56e646ef93ee11eeab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Lobshot


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8265a48b18b9fca04653fdf9000ce8bf9271e85ea9bf1f56e646ef93ee11eeab
SHA3-384 hash: c5a2abcc6771527ad0cc957b130fb413002d74358076021b78c80e8bfadf27effbb1267052170ffadfec20a5726264eb
SHA1 hash: 3d023790c74235c4ef77452e58f5191a93720379
MD5 hash: 70f3e57916b9fb4109375eb760b9d5fe
humanhash: double-florida-artist-iowa
File name:surin_elephant_patched.exe
Download: download sample
Signature Lobshot
Create hunting rule
File size:2'976'768 bytes
First seen:2023-07-06 04:33:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c843070d0647a0de2aec007cdc8284b9 (1 x Lobshot)
ssdeep 24576:KjqEDdPxmg4KzMy1GiGto4jGUfdCrLOu5lfLF9D4OAj:KjqEDigKS2o4jhu57
TLSH T1D8D5B520F754388AF9E607BBC9FD26B98478ED9087CC40D7418165C7AD2E2E7353A9C6
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 74ecccccd4e9f4cc (1 x Lobshot, 1 x LummaStealer)
Reporter ankit_anubhav
Tags:exe Lobshot

Intelligence

File Origin
# of uploads :
1
# of downloads :
319
Origin country :
TH TH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
surin_elephant_patched.exe
Verdict:
Suspicious activity
Analysis date:
2023-07-06 04:36:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/71ef3920-7a11-4bc1-8971-0ca0b6b94a14

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/408718/
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.6709.11930.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/95698/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm control greyware lolbin packed
Link:
https://www.filescan.io/uploads/64a6443b89e309292a8abf72/reports/e3ceab16-db42-48ea-b4f2-3da989430113/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/8265a48b18b9fca04653fdf9000ce8bf9271e85ea9bf1f56e646ef93ee11eeab
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkVNC
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/174c69d3-9382-4dc6-9a4f-bd9527a22cef
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1267734
Signature
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8265a48b18b9fca04653fdf9000ce8bf9271e85ea9bf1f56e646ef93ee11eeab/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-07-06 04:34:06 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
7 of 38 (18.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qjs2jcyyxh6karst7x4qadhix6jhd2c6vg7r6vxgi3xzh3qr52vq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence spyware stealer
Link:
https://tria.ge/reports/230706-e64afsad3t/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Deletes itself
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
8309535e526cf7eab791082b6f1ae6961739d2826779f9e920c3ed684c6a28f1
MD5 hash:
5b88c77fc160abc43794ad4dfae6e6b1
SHA1 hash:
e8a747b31020e3f41002479e9e1186f4e463f458
Link:
https://www.unpac.me/results/c7e6d2b1-a493-4711-b046-76ddcb9de7ea/
SH256 hash:
8265a48b18b9fca04653fdf9000ce8bf9271e85ea9bf1f56e646ef93ee11eeab
MD5 hash:
70f3e57916b9fb4109375eb760b9d5fe
SHA1 hash:
3d023790c74235c4ef77452e58f5191a93720379
Link:
https://www.unpac.me/results/c7e6d2b1-a493-4711-b046-76ddcb9de7ea/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8265a48b18b9fca04653fdf9000ce8bf9271e85ea9bf1f56e646ef93ee11eeab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifcats referencing sandbox DLLs typically observed in sandbox evasion
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/408718/

Comments