MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 833ade8ecde03240d9d930ce9581b9af5bc3e30340bb5bab24b8a36b639629d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 833ade8ecde03240d9d930ce9581b9af5bc3e30340bb5bab24b8a36b639629d2
SHA3-384 hash: b86e4c14156ff8811edd4f2f93eea8cc26fa381cce7c56c7e70aff4cf744a7ef69f97b530d24fe76388833dabc38ff28
SHA1 hash: 255b82d6a9f7ee85ecea422ef29bfd1dac494363
MD5 hash: b1aaf3910686d9c7d955080c8c9782c0
humanhash: queen-yankee-kitten-harry
File name:Hooka.exe
Download: download sample
File size:8'297'984 bytes
First seen:2023-07-17 08:44:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f0ea7b7844bbc5bfa9bb32efdcea957c (58 x Sliver, 17 x CobaltStrike, 12 x AsyncRAT)
ssdeep 98304:e3CrN97ff09qMvxEBnwJX6J/ogiGtCZ4fq8udcZiTdWz:WcC9qNxwIJ/oXeq8IAMWz
Threatray 13 similar samples on MalwareBazaar
TLSH T129868D43F85465A8C6EDD2308A758212BB31BC881B3577D32B61F6B92B73BD45BB9340
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter obfusor
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
AR AR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Hooka.exe
Verdict:
No threats detected
Analysis date:
2023-07-17 08:45:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c4ef2236-fc6c-4989-b64f-84b51c7cebdd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/422149/
Detection(s):
SecuriteInfo.com.FileRepMalware.3176.16262.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cobalt expand golang greyware lolbin packed
Link:
https://www.filescan.io/uploads/64b4ff8ff52c3e1a0149afbf/reports/8014af5d-49de-413e-91d6-74b9ccf59672/overview
Verdict:
Malicious
Labled as:
WinGo/ShellcodeRunner.JY trojan
Link:
https://www.hybrid-analysis.com/sample/833ade8ecde03240d9d930ce9581b9af5bc3e30340bb5bab24b8a36b639629d2
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/57d9d1f6-a436-40b6-85ee-308440075a11
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1274285
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1274285 Sample: Hooka.exe Startdate: 17/07/2023 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 6 Hooka.exe 1 2->6         started        process3 process4 8 conhost.exe 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/833ade8ecde03240d9d930ce9581b9af5bc3e30340bb5bab24b8a36b639629d2/
Threat name:
Win64.Trojan.TrickbotCrypt
Create hunting rule
Status:
Malicious
First seen:
2023-07-17 07:47:51 UTC
File Type:
PE+ (Exe)
AV detection:
20 of 37 (54.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qm5n5dwn4azebwozgdhjlanzv5n4hyydic5vxkzexcrwwy4wfhja._file
Verdict:
unknown
Similar samples:
27e8311a78358fac78a90f16012fb37e44ba7a57243346aefad8ca6e069b8d60
43f0d4ae7757937f33e90031a0aafc7828300bfe8074f022d0c1988ffa28e45a
44667a988cc089bf72554f869e1f6552b5ec206b0d2dcaf34e79482d8fef404a
571310e22d7af6225369f53b33887466dfa07afb8776bfae70eea5983212bfc1
62fbacc70c7b00faaf1f5a0a77e414d404137f5a1ef2d23ed14382eed130795a
726c2c2b35cb1adbe59039193030f23e552a28226ecf0b175ec5eba9dbcd336e
bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df
c7c145fef7419f2bae82b16c2d08d71310cb1504d3d66e9081b40501c1499087
cb4257531a81242176d9921778a8cc95dcf6c592563f97ccc0e7788a3cafc6e9
d1960cecd43b18f2bba88cf2d8792a4f2f40ae777317ee704ac2bedf1601a963
+ 3 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230717-knqjjabf4s/
Unpacked files
SH256 hash:
833ade8ecde03240d9d930ce9581b9af5bc3e30340bb5bab24b8a36b639629d2
MD5 hash:
b1aaf3910686d9c7d955080c8c9782c0
SHA1 hash:
255b82d6a9f7ee85ecea422ef29bfd1dac494363
Link:
https://www.unpac.me/results/c2fd8a55-9f17-46f8-8539-5db0a4d74052/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/833ade8ecde03240d9d930ce9581b9af5bc3e30340bb5bab24b8a36b639629d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/422149/

Comments