MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 881b7822da80cffa41cc1c6211f554a42ee4ea92340cbdd1d51df9d20a193b03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 881b7822da80cffa41cc1c6211f554a42ee4ea92340cbdd1d51df9d20a193b03
SHA3-384 hash: 80c8cd3ad798af690be79ccfd6cb56efd1b9df84a9df13a48584e7acc2b2e910439f12fd47266011c1dd153b1fe2f4fb
SHA1 hash: 16bad851fe2abc58fc3e559ed07109653f546a1a
MD5 hash: be9018dc026975bb13411667e15e3765
humanhash: oranges-uniform-undress-six
File name:autorizacaoBUWFZCZN.msi
Download: download sample
File size:24'596'480 bytes
First seen:2023-02-07 17:03:28 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 393216:4F+EEVZJtucWZQ1e3hhpOBJnsKn409u4EIZWSim0BR422pysbX1ADcKADxeQ:1ucWZS8UznxnuiyBLWyiX1ADcKg
Threatray 99 similar samples on MalwareBazaar
TLSH T15F47D320D3737CD9EA2762BFF0AC5FC58110F5E1A118E66B737C3BA58AD064661B6903
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
shell32.dll
Link:
https://www.filescan.io/uploads/63e28485416d38777a7ab53f/reports/d84987c4-9b90-4cc7-8b79-fabf22c471c8/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/881b7822da80cffa41cc1c6211f554a42ee4ea92340cbdd1d51df9d20a193b03
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/881b7822da80cffa41cc1c6211f554a42ee4ea92340cbdd1d51df9d20a193b03
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1168312
Signature
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-02-07 01:35:04 UTC
File Type:
Binary (Archive)
Extracted files:
79
AV detection:
4 of 39 (10.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ranxqiw2qdh7uqomdrrbd5kuuqxoj2usgqgl3uovdx45ecqzhmbq._file
Verdict:
unknown
Similar samples:
18e57acc198a3afad96f6fff17a0cc538da02afcba38036dda6cf1b8902efd2b
27b5e52c0c575a9d1a1e460ee54fc4f411fd5783b886854d332253c4ff80c51e
3984f829f5857c513de4b0c89a2e4ccc31e05f19100d575714471d0657b5734d
4296080a2384f70638c544c1a4d598035cb895e7346080960df2413510e0c04a
4e3a2efe25c0c1f9771e113c357728e2da8fda16c1d566385dd7ca82d5986481
4f6cb888a4dfade727490683feaee96679d7044f0181799c18a8c7060cb8dab3
7321a205de31cb4c93f10a090316502922d9083dfc076c93903377f36ada3aca
db1d955d0078b3742f10f891b52782101b01a32061cbf250ccdeb1f02beae663
ffb318a5fd569396377f80259fb3b2ff02ef492efa1922ccbdd1bcdf1f43c162
+ 89 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/230207-vk94waga4w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/881b7822da80cffa41cc1c6211f554a42ee4ea92340cbdd1d51df9d20a193b03

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments