MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 881bc433878a646cd64f7de9cfebe8512b84fd4b37beaa793a31ca8803b31411. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 881bc433878a646cd64f7de9cfebe8512b84fd4b37beaa793a31ca8803b31411
SHA3-384 hash: 8bb3c3e470f83f3c7d13db806909166f6fe229c20782a77cde65d2286816febab2c307bc4892ec95fb62f0aa2b09ca68
SHA1 hash: 820236104fa0e3c01db19bf828372b7f93bf2202
MD5 hash: 76be72ba60795557a7dacd6230759021
humanhash: idaho-mockingbird-fifteen-yankee
File name:SecuriteInfo.com.Win32.CrypterX-genTrj.8110.29378
Download: download sample
File size:33'792 bytes
First seen:2022-03-23 09:13:23 UTC
Last seen:2022-03-25 07:15:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 384:EPkNlxfZSCsur3Od3hU2zJAlRm7oQ+WR1OZJoFLixalGak8GXvzOk9rhbV4Q:EcNGWUhU0GlOoZZACaoak8GLOk9f
Threatray 9 similar samples on MalwareBazaar
TLSH T129E2F6617BE082B5ED5501B338FB7721D663B2CAFB8697DB6687C1150DC12906F22339
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/255885/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-genTrj.8110.29378.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file
Launching a process
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file in the Windows subdirectories
DNS request
Moving a recently created file
Creating a file in the %temp% directory
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/623ae4f6b94fb38cb4d7f5ab/reports/654fcf35-c97c-420f-890c-b0a25013f283/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/962713
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/881bc433878a646cd64f7de9cfebe8512b84fd4b37beaa793a31ca8803b31411/
Threat name:
Win32.Trojan.RealProtectPENGSD
Create hunting rule
Status:
Malicious
First seen:
2022-03-23 08:22:56 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
17 of 42 (40.48%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
03811aadd6602954413ae6ed4bcddc6faa77172cbdc58639d060ebb3e875ce3e
13bebb6b12d0c7237e79e61a431d3d537f53e8b6a4725340c75dc9337d56e830
1ca0216d0d70df84f12b955ad54bc99c42b783320de730f7edb060aa4cf5e0cd
2b0ec06149fb774d9b380ef811688ba427ed5fe9c44f76627cb06a20091c2c92
5f8f9fad7398e70744fd2ea096ff18932cc69e310ce55a3c41217621b9b98545
a2716f4abbe471854f3ab8658e6f82528adadf76b09b38e4481f68d9b6318dff
a3e066057917fd9c0774744ac02f05d3f8e993354249698db1ce599188dae123
d5a66c07e5c30270bc05064a563fef11f1a8eac8c4dbea9bf1aea9fc76b3ef9e
fccdebaea1d99fdbb92837bc7a7628cc7719ab4b35c102ea9adfb2e40b28f131
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/220323-k7jkbsfgam/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Loads dropped DLL
Unpacked files
SH256 hash:
6cb61838e78eec69e44134bf8706fa5d3ae699e6fb7f47a6c95f3e135217f35a
MD5 hash:
5cced48e29a7438ed53c4a281f625fe4
SHA1 hash:
bba6b88e0147bdfa6ef9486173b294f64cc026f9
Link:
https://www.unpac.me/results/7fef9b94-a340-4177-83fc-d4c7cd7ca85f/
SH256 hash:
881bc433878a646cd64f7de9cfebe8512b84fd4b37beaa793a31ca8803b31411
MD5 hash:
76be72ba60795557a7dacd6230759021
SHA1 hash:
820236104fa0e3c01db19bf828372b7f93bf2202
Link:
https://www.unpac.me/results/7fef9b94-a340-4177-83fc-d4c7cd7ca85f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/881bc433878a646cd64f7de9cfebe8512b84fd4b37beaa793a31ca8803b31411

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 881bc433878a646cd64f7de9cfebe8512b84fd4b37beaa793a31ca8803b31411

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2111886/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/255885/

Comments