MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d2d9fefd3ca354acd3c399119968a3f5617a2de3c7edfa52a12873f3574bb2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8d2d9fefd3ca354acd3c399119968a3f5617a2de3c7edfa52a12873f3574bb2e
SHA3-384 hash:	78a0508a3d2833c9ba53a0a8cdc58938114adc5df63af63819bb08f5578a3c01e60559288c5323a11806f6761a496941
SHA1 hash:	769a23f82abf4f726aa83e39454ea37e5294d26b
MD5 hash:	d8e76fd3e86a03ba61163aa7462b6b07
humanhash:	queen-india-angel-glucose
File name:	file
Download:	download sample
File size:	2'782'677 bytes
First seen:	2023-12-09 14:50:49 UTC
Last seen:	2023-12-09 16:39:02 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	7a5e2524b66da5177b4ec46d305a3dd7
ssdeep	49152:IS49N4xXudTuq3WyAW4GTAaoolHigr4l6WBNSrJ1t7q9al2201rdlrTACyILE:ISkmHyAWbTAaoopisWfitqI2Fd7yKE
Threatray	32 similar samples on MalwareBazaar
TLSH	T1DBD5331457A81836DBF31AF8E16F9BE9317FDD3C62434406C5E5701BEA48729EA9E308
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	848c5454baf46e68 (1 x PrivateLoader)
Reporter	andretavare5
Tags:	exe

andretavare5

Sample downloaded from https://IOIOUOIUOUOUIYJGROUP.SBS/setup294.exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

312

Origin country :

US

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/464009/

ClamAV Detected

Detection(s):

Win.Packed.Zenpak-10014145-0

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Running batch commands

Launching a process

Sending a custom TCP request

Dragonfly

Gathering data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

installer lolbin overlay packed packed setupapi sfx shell32

Link:

https://www.filescan.io/uploads/65747ed73f60a810348d3248/reports/8ecc0488-254e-4f33-9573-f56a8e7e37a1/overview

Hybrid Analysis Trojan.Zenpak

Verdict:

Malicious

Labled as:

Trojan.Zenpak

Link:

https://www.hybrid-analysis.com/sample/8d2d9fefd3ca354acd3c399119968a3f5617a2de3c7edfa52a12873f3574bb2e

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Raspberry Robin

Malware family:

Raspberry Robin

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/66beb3fe-aff6-41ee-b732-8919e90f35f3

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1356923

Signature

Antivirus detection for dropped file

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/8d2d9fefd3ca354acd3c399119968a3f5617a2de3c7edfa52a12873f3574bb2e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8d2d9fefd3ca354acd3c399119968a3f5617a2de3c7edfa52a12873f3574bb2e/

ReversingLabs TitaniumCloud Win32.Trojan.Privateloader

Threat name:

Win32.Trojan.Privateloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-09 14:51:05 UTC

File Type:

PE (Exe)

Extracted files:

8

AV detection:

16 of 23 (69.57%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ruwz736tzi2uvtj4hgirtfukh5lbpiw6hr7n7jjkckdt6nluxmxa._file

Threatray unknown

Verdict:

unknown

Similar samples:

172c25ce4a5916f38026250b5799b318751216eb858a6b1230b039527115af52

22335125fc0f3e079a587ead4f6b3aeabd6bb5552b877dd0315b3d04077df868

2ce06ea838ff7987486eb638d2d2286b63b7ed6b27076ac528e31b5385f07106

85afab932ff85577a06a6d1751563e0461bea1a6ef0396cb5df81ef76b626530

8d2d9fefd3ca354acd3c399119968a3f5617a2de3c7edfa52a12873f3574bb2e

b081d89a5ba373e01fd64eb46f8781bb9068f3e9d88d8ce0db3e7ca6a3541c8a

d7017c00a3d60ff9c05f3a83e9694dd51c929ecdd1d339b9840c68bb8bce5e1a

+ 22 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/231209-r75wwsadf2/

Behaviour

Modifies registry class

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

cc5a24c16d3a874ca6725a5dfd8a4d5cf78548e462e5180a958d611c091cfbef

MD5 hash:

f9f6e3145d8a447eef4c115c4d0d72ab

SHA1 hash:

eaab7bea475195b38660de8b0ce3f5fdd30be11b

Link:

https://www.unpac.me/results/7f109d05-d5ea-4658-bce7-c01d65bc7498/

SH256 hash:

8d2d9fefd3ca354acd3c399119968a3f5617a2de3c7edfa52a12873f3574bb2e

MD5 hash:

d8e76fd3e86a03ba61163aa7462b6b07

SHA1 hash:

769a23f82abf4f726aa83e39454ea37e5294d26b

Link:

https://www.unpac.me/results/7f109d05-d5ea-4658-bce7-c01d65bc7498/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8d2d9fefd3ca354acd3c399119968a3f5617a2de3c7edfa52a12873f3574bb2e

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

Dropped by

PrivateLoader

  

Delivery method

Distributed via drive-by

  

URLhaus

https://urlhaus.abuse.ch/url/2738682/

Cape

https://www.capesandbox.com/analysis/464009/