MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8aa0c0d3d0fbb72a3f19886f93efcdfe2438880294c627eeb1f295097e67cf58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Nitol


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8aa0c0d3d0fbb72a3f19886f93efcdfe2438880294c627eeb1f295097e67cf58
SHA3-384 hash: 8eba7a21fbf936755e2d037a8367a8597239b7da63b1a1f77cd6ba66e36a3dbc28e5f3a3672a63f5a9edcd134ce27d03
SHA1 hash: bab33409a0ae5b3a203d2c07a1294a086e65444b
MD5 hash: a8a2233b38793d77203a29fee7288bc8
humanhash: mobile-missouri-august-fruit
File name:国外暴利行业奢靡生活记录视频.com
Download: download sample
Signature Nitol
Create hunting rule
File size:2'252'800 bytes
First seen:2021-11-11 18:54:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 522b3c5f996a02332ad67eb756645e92 (1 x Nitol)
ssdeep 49152:lNkViWAHlLDTj2TIADhIkbet0P4s5FuB+jyoOBaH:lJlCVFuJoO
Threatray 63 similar samples on MalwareBazaar
TLSH T1EBA57C25BA944075D6BB22361D2D727885AED460CB20C9DB57A8CFFA2DB13C11F3874B
Reporter ActorExpose
Tags:exe Nitol

Intelligence

File Origin
# of uploads :
1
# of downloads :
183
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8aa0c0d3d0fbb72a3f19886f93efcdfe2438880294c627eeb1f295097e67cf58.exe
Verdict:
Malicious activity
Analysis date:
2021-11-11 19:09:04 UTC
Tags:
trojan
Link:
https://app.any.run/tasks/0b2cecb1-ba42-402f-9bd5-aa24151daa0b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Nitol
Create hunting rule
Link:
https://www.capesandbox.com/analysis/205114/
Detection(s):
Win.Malware.Farfli-6824119-0
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware icedid keylogger packed
Link:
https://www.filescan.io/uploads/618d6708a00afa9663a4455f/reports/c42153eb-e0a4-4e24-b6bf-a7da596080d6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Farfli
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/978d64ff-f96c-4178-8768-9926227413ef
Result
Threat name:
Unknown
Detection:
malicious
Classification:
bank.spyw.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/887729
Signature
Checks if browser processes are running
Contains functionality to capture and log keystrokes
Malicious sample detected (through community Yara rule)
Tries to evade analysis by execution special instruction which cause usermode exception
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8aa0c0d3d0fbb72a3f19886f93efcdfe2438880294c627eeb1f295097e67cf58/
Threat name:
Win32.Backdoor.Farfli
Create hunting rule
Status:
Malicious
First seen:
2021-11-11 18:55:06 UTC
AV detection:
19 of 44 (43.18%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rkqmbu6q7o3supyzrbxzh36n7ysdrcacstdcp3vr6kkqs7thz5ma._file
Verdict:
malicious
Similar samples:
0108dfda636ea3e4767b39912125875976805997a727ec8248a2e93a44e3e113
Nitol
1cebb1153264ff7d706895a8a17411f4f037ee4854756ce90ee0506af73d5fe7
Nitol
231994c79a1fafe117deeb111a6ba3c026afa18a1e89522b8f81cc2f68dfd10a
Nitol
5e4b70fa595cb17cba9e674ec3fa574d830b43d3a4b6b3417d8c8c243880e93c
Nitol
923dec45c173d8b56592b19aab3f84b6aa094b7e0a17def69e098ea9049b1a84
Nitol
92a80b053f4276ced8cdd30ef3e2e38026cb69ae081b24faf5a69a909074bb39
Nitol
afa039970dda1afcdacd878f5fd125dd6ed37b80e8d7cbe37ec91871f4ab8eb0
Nitol
c8605992ffb507e5f35424921c2efb8a3234005e559398637fd8104f6f0373c5
Nitol
+ 53 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/211111-xkrzeabhh7/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Drops file in Program Files directory
Adds Run key to start application
Enumerates connected drives
Unpacked files
SH256 hash:
6435a430967d5ccab76909a1069cbf4ec0b28d4531665f5a0fd10aa0124d252b
MD5 hash:
752a4d2844e532c57deeb12ba3a7c3f7
SHA1 hash:
e9f6eae38129ada33e648d8ef5b7328885ecee82
Link:
https://www.unpac.me/results/72b681f2-086e-47ba-aa00-363221763022/
SH256 hash:
8aa0c0d3d0fbb72a3f19886f93efcdfe2438880294c627eeb1f295097e67cf58
MD5 hash:
a8a2233b38793d77203a29fee7288bc8
SHA1 hash:
bab33409a0ae5b3a203d2c07a1294a086e65444b
Link:
https://www.unpac.me/results/72b681f2-086e-47ba-aa00-363221763022/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/8aa0c0d3d0fbb72a3f19886f93efcdfe2438880294c627eeb1f295097e67cf58

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Backdoor_Nitol_Jun17
Create hunting rule
Author:Florian Roth
Description:Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader
Reference:https://goo.gl/OOB3mH
Rule name:Backdoor_Nitol_Jun17_RID2E8F
Create hunting rule
Author:Florian Roth
Description:Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader
Reference:https://goo.gl/OOB3mH
Rule name:MALWARE_Win_Nitol
Create hunting rule
Author:ditekSHen
Description:Detects Nitol backdoor
Rule name:MAL_Nitol_Malware_Jan19_1
Create hunting rule
Author:Florian Roth
Description:Detects Nitol Malware
Reference:https://twitter.com/shotgunner101/status/1084602413691166721
Rule name:win_younglotus_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.younglotus.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/205114/

Comments