MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d0191d24b9d62100603d7640fe138d5eb005f758fa77cbcf0434e317286db6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8d0191d24b9d62100603d7640fe138d5eb005f758fa77cbcf0434e317286db6c
SHA3-384 hash:	0a580aa346507174c6f60be5ba6bcd5e4a28bada1b52a8e8378b4b42079d1e9cd515ad7f5415be59017da12d3795d5f9
SHA1 hash:	883889f130a26a11f02648849829d3ba0f208fb6
MD5 hash:	779ff91d6893229708d97f21cb2c9e4d
humanhash:	johnny-quebec-cold-mobile
File name:	SecuriteInfo.com.Win32.Evo-gen.6656.15576
Download:	download sample
File size:	2'324'760 bytes
First seen:	2023-09-30 13:29:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4ba3ea0d6362a841ec66a1fc0a1b874f
ssdeep	49152:ufBudeLGQtMYIcoU9qia+cKu2RiviribhMTQvRkVejWEGEBG:reLfMiNc+uiubhKf7SG
Threatray	6 similar samples on MalwareBazaar
TLSH	T135B533217BE7C07FE0A20231E5D87BB045BE83690F0865D367E59B9C5A386F2A775348
TrID	38.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 24.6% (.EXE) Win64 Executable (generic) (10523/12/4) 11.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.5% (.EXE) Win32 Executable (generic) (4505/5/1) 4.7% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox)
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

268

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/452285/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.Evo-gen.6656.15576.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Launching cmd.exe command interpreter

Launching a process

Сreating synchronization primitives

Creating a process with a hidden window

Searching for the window

Dragonfly

Gathering data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  10/10

Confidence:

100%

Tags:

installer lolbin overlay packed SFX shell32

Link:

https://www.filescan.io/uploads/651822e11edabd9982a25098/reports/e0db8aae-eb92-40da-84e2-12c3dfb17f8f/overview

Hybrid Analysis Trojan.DuckTail

Verdict:

Malicious

Labled as:

Trojan.DuckTail

Link:

https://www.hybrid-analysis.com/sample/8d0191d24b9d62100603d7640fe138d5eb005f758fa77cbcf0434e317286db6c

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Generic Malware

Malware family:

Generic Malware

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ead03d96-30f8-4534-b958-53e1f1264375

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1317191

Signature

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8d0191d24b9d62100603d7640fe138d5eb005f758fa77cbcf0434e317286db6c/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-09-30 13:30:09 UTC

File Type:

PE (Exe)

Extracted files:

8

AV detection:

12 of 23 (52.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ruazdusltvrbabqd25sa7yjy2xvqax3vr6txzphqinhdc4ug3nwa._file

Threatray malicious

Verdict:

malicious

Similar samples:

64119e925a2c5fe96481a18acdab674856490be0a3051e5e4508ac20a83ad42e

657ce9b72278bcbc3d100ea8a012381ceee3402bcb19977befb69f4d7459275b

71ba25a8276d119cdf3249f4f5427a2b2b07ba291434ede3d0d84bed4143cc63

71cee2ccfe6e1198949c920b69503a096154b67c04569669f4597837d3ef1e69

da9556ef3fd609709cc07f635978b1d428cd8bd681ebbe1679b5f7c10fa0270e

fc73b102e40787082518533d6c871d300ce4c4bcb83700e0c21b5e4fc6098203

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230930-qrtcgseb35/

Behaviour

Suspicious use of WriteProcessMemory

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

73cf2b099ff17a5ab34c669c5c29e58c33e2db003d0be302c6f5ebbe1347316d

MD5 hash:

569f413b4e23919c28e91991e75ed6c0

SHA1 hash:

a6562ded36d587a49f20892655f4be07bbd68bee

Link:

https://www.unpac.me/results/eceef6e8-1d95-45f7-a07e-de451ddeb266/

SH256 hash:

8d0191d24b9d62100603d7640fe138d5eb005f758fa77cbcf0434e317286db6c

MD5 hash:

779ff91d6893229708d97f21cb2c9e4d

SHA1 hash:

883889f130a26a11f02648849829d3ba0f208fb6

Link:

https://www.unpac.me/results/eceef6e8-1d95-45f7-a07e-de451ddeb266/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8d0191d24b9d62100603d7640fe138d5eb005f758fa77cbcf0434e317286db6c

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 8d0191d24b9d62100603d7640fe138d5eb005f758fa77cbcf0434e317286db6c

(this sample)

Cape

https://www.capesandbox.com/analysis/452285/

  

URLhaus

https://urlhaus.abuse.ch/url/2715154/

  

Delivery method

Distributed via web download