MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a283c4d96c65dcfd2cf5439c093799990a0963d015c408046dc1fa04d1c84b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a283c4d96c65dcfd2cf5439c093799990a0963d015c408046dc1fa04d1c84b9
SHA3-384 hash: 8e452878c9c8dfbf4a02c6a10450a98d166cbd42c797de75f3e7ebf84ce6e0cd16a322c48104742ea89166c20a3696a6
SHA1 hash: 15480a1610cffc38433adaafa3cac3703a7089d5
MD5 hash: d961424324faac2cc7d6960066df4927
humanhash: bakerloo-seventeen-apart-floor
File name:#Fsysna_msword.bin
Download: download sample
File size:557'730 bytes
First seen:2021-09-08 12:11:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c127345c03c7eb109783c6cc61e16834 (5 x AgentTesla, 2 x RedLineStealer, 1 x RecordBreaker)
ssdeep 12288:q9UPHFtPUX+tG2ZIDcL143gyU0rZlabTLoH:q9qFtP8Q7dyPCTLoH
Threatray 620 similar samples on MalwareBazaar
TLSH T1EEC4F111B9C181B2E4735938AAF5A7706A3D7C201F348E5F93983F6E4F701D0A629B67
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter KodaES
Tags:exe Fsysna TransparentTribe


Avatar
KodaES
https://app.any.run/tasks/41c64dde-acfb-423a-8036-fa2c57e0943e#
https://www.virustotal.com/gui/file/8a283c4d96c65dcfd2cf5439c093799990a0963d015c408046dc1fa04d1c84b9

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Dropper.Script.doc
Verdict:
Malicious activity
Analysis date:
2021-09-08 11:53:17 UTC
Tags:
macros macros-on-open
Link:
https://app.any.run/tasks/41c64dde-acfb-423a-8036-fa2c57e0943e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/186340/
Detection(s):
PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.VBS.Starter.180.11705.3523.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
DNS request
Connection attempt
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e5db9385-282a-4491-9559-ede72e0ca316
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/847368
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to detect sleep reduction / modifications
Creates multiple autostart registry keys
Drops PE files with benign system names
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: System File Execution Location Anomaly
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 479795 Sample: #Fsysna_msword.bin Startdate: 08/09/2021 Architecture: WINDOWS Score: 92 24 us-east-1.route-1.000webhost.awex.io 2->24 26 fiberxwashin.000webhostapp.com 2->26 48 Antivirus / Scanner detection for submitted sample 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 Machine Learning detection for sample 2->52 54 Sigma detected: System File Execution Location Anomaly 2->54 7 #Fsysna_msword.exe 10 2->7         started        11 csrss.exe 9 2->11         started        14 csrss.exe 11 2->14         started        16 2 other processes 2->16 signatures3 process4 dnsIp5 22 C:\Users\user\AppData\Roaming\...\csrss.exe, PE32 7->22 dropped 64 Drops PE files with benign system names 7->64 18 csrss.exe 2 9 7->18         started        34 145.14.144.168, 49876, 49880, 49920 AWEXUS Netherlands 11->34 42 3 other IPs or domains 11->42 36 145.14.145.211, 49774, 49781, 49783 AWEXUS Netherlands 14->36 44 3 other IPs or domains 14->44 38 145.14.144.173, 49816, 49825, 49832 AWEXUS Netherlands 16->38 40 145.14.144.49, 49939, 49944, 80 AWEXUS Netherlands 16->40 46 9 other IPs or domains 16->46 file6 signatures7 process8 dnsIp9 28 www.google.com.pk 142.250.102.94, 49738, 49739, 49753 GOOGLEUS United States 18->28 30 145.14.144.122, 49744, 49745, 49746 AWEXUS Netherlands 18->30 32 5 other IPs or domains 18->32 56 Antivirus detection for dropped file 18->56 58 Multi AV Scanner detection for dropped file 18->58 60 Creates multiple autostart registry keys 18->60 62 Contains functionality to detect sleep reduction / modifications 18->62 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a283c4d96c65dcfd2cf5439c093799990a0963d015c408046dc1fa04d1c84b9/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2021-07-04 18:20:50 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
3f3db971f1d2721ac273e60fb9b0e172bb635f8f5e7889eaf9fc59d61edd5ddc
5eeeae5aa5d31a7ee09a0bf20995c6b52cb73ea634a563c2220dc7bc3444a60d
72369151d3db2db1344f78c7f0cfbf036775b9320b7a930bad9c436503bd2584
7b8d051db7c6022c15d87abe13122f36e303b94f8616fe26a6d34d04b0a3889f
935099f2160f2dd5fec6a63ea02c81d80c0b2cbf712b0e48b386a81078a627dd
aec584f657593d973f0e14a4cb30e6ceeb27c9173b72816a4123ba9cd4e90c1c
ca5bf1a6c94417ce81dd3d605748406ef97e5ad47c26b36e55f0e2b9dd4a56e5
d2d90f02ccd7c3fd1b46d667081529a1af8172e4a51feda461c8d250081c3548
e184eaf3a4654b623d6d0aace224406b6ed11b5ef3f30c9f8b4f700524fc5ed3
e38724644ed4643ebcdea6b0ae8345bf094d9f6e6d81b0acb244f96a3129077e
+ 610 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/210908-pcnm1sedg7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks installed software on the system
Executes dropped EXE
Unpacked files
SH256 hash:
19211263895aef3ac47e0e6d89a0ecd4890e692bb18e864409936ee7c0e92466
MD5 hash:
43197613ab30e12fcca16ed7672a46af
SHA1 hash:
263aab9668a67f5deb3d65d113e7416499383f69
Link:
https://www.unpac.me/results/01da2979-5c87-418c-a954-455399399831/
SH256 hash:
8a283c4d96c65dcfd2cf5439c093799990a0963d015c408046dc1fa04d1c84b9
MD5 hash:
d961424324faac2cc7d6960066df4927
SHA1 hash:
15480a1610cffc38433adaafa3cac3703a7089d5
Detections:
win_retefe_auto
Create hunting rule
Link:
https://www.unpac.me/results/01da2979-5c87-418c-a954-455399399831/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8a283c4d96c65dcfd2cf5439c093799990a0963d015c408046dc1fa04d1c84b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_retefe_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.retefe.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/186340/

Comments