MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8eea00bd7d1db820c7a1b5622119b76944215e5803c2e8b772b9548e9ee91c66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DiamondFox


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8eea00bd7d1db820c7a1b5622119b76944215e5803c2e8b772b9548e9ee91c66
SHA3-384 hash: 84ec22a0ce838b294c510c845a2f9109a7b3cd4bcbcba8d245c6ae5a40463d4e44794439405593df073b94d510a9b0a6
SHA1 hash: 99d980acadd231db0ec5cc73d39ee6e229a22475
MD5 hash: de84761745481d3020af18fc0c3eef6e
humanhash: carolina-grey-yellow-burger
File name:DE84761745481D3020AF18FC0C3EEF6E.exe
Download: download sample
Signature DiamondFox
Create hunting rule
File size:8'933'385 bytes
First seen:2021-08-16 04:15:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 196608:UaE5HysgxHk3wONlCTP86GU2JNdd8Ct8IV3hZ5P:1E5HUejeTPmUAjKCtN5FP
Threatray 269 similar samples on MalwareBazaar
TLSH T17896338578A0C5B1C7F10D3A03A8B3A4647DAD201F2A4A9F53D4756FEE750C2EE356A3
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter abuse_ch
Tags:DiamondFox exe


Avatar
abuse_ch
DiamondFox C2:
188.124.36.242:25802

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
188.124.36.242:25802 https://threatfox.abuse.ch/ioc/189204/

Intelligence

File Origin
# of uploads :
1
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DE84761745481D3020AF18FC0C3EEF6E.exe
Verdict:
Malicious activity
Analysis date:
2021-08-16 04:18:49 UTC
Tags:
evasion trojan rat redline stealer phishing
Link:
https://app.any.run/tasks/a066333c-a361-462e-85c1-33db5c7477e5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CookieStealer
Create hunting rule
Link:
https://www.capesandbox.com/analysis/179406/
Detection(s):
Win.Malware.Qshell-9875653-0
Create hunting rule

Win.Malware.Chapak-9883695-0
Create hunting rule

SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Creating a file in the %temp% directory
Launching the default Windows debugger (dwwin.exe)
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Reading critical registry keys
Sending an HTTP POST request
Using the Windows Management Instrumentation requests
Launching a process
Creating a file in the %AppData% directory
Sending a TCP request to an infection source
Creating a file
Deleting a recently created file
Creating a process with a hidden window
Sending a UDP request
Delayed reading of the file
Running batch commands
Possible injection to a system process
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Blocking the Windows Defender launch
Query of malicious DNS domain
Connection attempt to an infection source
Unauthorized injection to a recently created process by context flags manipulation
Sending an HTTP GET request to an infection source
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Bsymem
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/66c0e8e7-de51-4e9f-9fe3-93e444f3518a
Result
Threat name:
Backstage Stealer Glupteba Metasploit Ni
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/833288
Signature
.NET source code contains very large strings
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Creates HTML files with .exe extension (expired dropper behavior)
Creates processes via WMI
Detected unpacking (changes PE section rights)
Detected VMProtect packer
Disable Windows Defender real time protection (registry)
Drops PE files to the document folder of the user
Drops PE files to the user root directory
Found Tor onion address
Machine Learning detection for dropped file
May modify the system service descriptor table (often done to hook functions)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Query firmware table information (likely to detect VMs)
Sample is protected by VMProtect
Sets debug register (to hijack the execution of another thread)
Sigma detected: Suspicious Svchost Process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Backstage Stealer
Yara detected Glupteba
Yara detected Metasploit Payload
Yara detected Nitol
Yara detected RedLine Stealer
Yara detected Socelars
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 465719 Sample: 6Tpe3Mu1Nd.exe Startdate: 16/08/2021 Architecture: WINDOWS Score: 100 83 104.21.17.130 CLOUDFLARENETUS United States 2->83 85 155.94.160.223 ASN-QUADRANET-GLOBALUS United States 2->85 125 Antivirus detection for URL or domain 2->125 127 Antivirus detection for dropped file 2->127 129 Multi AV Scanner detection for dropped file 2->129 131 18 other signatures 2->131 11 6Tpe3Mu1Nd.exe 15 2->11         started        signatures3 process4 file5 51 C:\Users\user\Desktop\pub2.exe, PE32 11->51 dropped 53 C:\Users\user\Desktop\mysetold.exe, PE32 11->53 dropped 55 C:\Users\user\Desktop\md9_1sjm.exe, PE32 11->55 dropped 57 7 other files (6 malicious) 11->57 dropped 14 Install_Files.exe 11->14         started        19 Complete.exe 11->19         started        21 Files.exe 3 2 11->21         started        23 7 other processes 11->23 process6 dnsIp7 91 37.0.10.236 WKD-ASIE Netherlands 14->91 93 37.0.11.8 WKD-ASIE Netherlands 14->93 97 12 other IPs or domains 14->97 65 C:\Users\...\yupnOs1PtIcCC5rkTnZAwQkY.exe, PE32 14->65 dropped 67 C:\Users\...\x4koWWhW5ck5iWMVKW4cA0qM.exe, PE32 14->67 dropped 75 47 other files (36 malicious) 14->75 dropped 107 Drops PE files to the document folder of the user 14->107 109 Creates HTML files with .exe extension (expired dropper behavior) 14->109 111 Tries to harvest and steal browser information (history, passwords, etc) 14->111 113 Disable Windows Defender real time protection (registry) 14->113 95 136.144.41.201 WORLDSTREAMNL Netherlands 19->95 99 4 other IPs or domains 19->99 69 C:\Users\...\z_Nm3ufGzyMz9y4oZVzEyQ3P.exe, PE32 19->69 dropped 71 C:\Users\...\zRfpLwmpkGuI544yC_GFVm7e.exe, PE32 19->71 dropped 73 C:\Users\...\zRNF4DYniPDm17OyYSCTB2Ap.exe, PE32 19->73 dropped 77 47 other files (35 malicious) 19->77 dropped 101 4 other IPs or domains 21->101 79 2 other files (none is malicious) 21->79 dropped 25 jfiag3g_gg.exe 1 21->25         started        27 jfiag3g_gg.exe 21->27         started        103 5 other IPs or domains 23->103 81 8 other files (4 malicious) 23->81 dropped 115 Detected unpacking (changes PE section rights) 23->115 117 Drops PE files to the user root directory 23->117 119 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 23->119 121 2 other signatures 23->121 30 Folder.exe 5 23->30         started        33 WerFault.exe 23->33         started        35 conhost.exe 23->35         started        37 explorer.exe 23->37 injected file8 signatures9 process10 dnsIp11 39 rundll32.exe 25->39         started        87 192.168.2.1 unknown unknown 27->87 59 C:\Users\user\AppData\Local\Temp\axhub.dll, PE32 30->59 dropped 61 C:\...\api-ms-win-core-string-l1-1-0.dll, PE32 30->61 dropped 63 C:\...\api-ms-win-core-namedpipe-l1-1-0.dll, PE32 30->63 dropped 42 conhost.exe 30->42         started        89 13.89.179.12 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 33->89 file12 process13 signatures14 133 Writes to foreign memory regions 39->133 135 Allocates memory in foreign processes 39->135 137 Creates a thread in another existing process (thread injection) 39->137 44 svchost.exe 39->44 injected process15 signatures16 139 Sets debug register (to hijack the execution of another thread) 44->139 141 Modifies the context of a thread in another process (thread injection) 44->141 47 svchost.exe 44->47         started        process17 dnsIp18 105 34.97.69.225 GOOGLEUS United States 47->105 123 Query firmware table information (likely to detect VMs) 47->123 signatures19
Detection:
raccoon
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8eea00bd7d1db820c7a1b5622119b76944215e5803c2e8b772b9548e9ee91c66/
Threat name:
Win32.Trojan.CookiesStealer
Create hunting rule
Status:
Malicious
First seen:
2021-08-07 17:11:31 UTC
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r3vabpl5dw4cbr5bwvrccgnxnfcccxsyapborn3sxfki5hxjdrta._file
Verdict:
malicious
Similar samples:
31452b50fe8475fa4566b814ed702c6910029ff66db45d3dbb21c2e3ed63594f
DiamondFox
3555826df75751600d127b343a3214a0f9b4c211b1fdcdf9ccceb1dda6be5f27
DiamondFox
55da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241
DiamondFox
5cb7dc8f48821f9e1f48c9d2d52f0f8e435c1286e5e0df3551f614deccdc47dc
DiamondFox
7fec25753b7597c9bf89e634043cc93f7bfd724d4c2f09e02b2c0aeefd0c99ed
DiamondFox
908b275d6fc2f20e9d04e8609a9d994f7e88a429c3eb0a55d99ca1c681e17ec8
DiamondFox
a526e9dae9298bbd03ca2a8fc8a45809eac1543bbec4680182493c551d65f731
DiamondFox
d82cb4755924ead169ce150c3e22d12a1820d92e65bf5dfa4c7003b3147441f3
DiamondFox
d9008ee980c17de8330444223b212f1b6a441f217753471c76f5f6ed5857a7d6
DiamondFox
+ 259 additional samples on MalwareBazaar
Result
Malware family:
socelars
Create hunting rule
Score:
  10/10
Tags:
family:glupteba family:metasploit family:raccoon family:redline family:smokeloader family:socelars botnet:7f2d7476ae0c3559a3dfab1f6e354e488b2429a1 botnet:7new botnet:@soul3ss backdoor dropper infostealer loader persistence spyware stealer suricata trojan upx vmprotect
Link:
https://tria.ge/reports/210816-7byx93g3va/
Behaviour
Checks SCSI registry key(s)
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
autoit_exe
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
UPX packed file
VMProtect packed file
Glupteba
Glupteba Payload
MetaSploit
Process spawned unexpected child process
Raccoon
RedLine
RedLine Payload
SmokeLoader
Socelars
Socelars Payload
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Malware Config
C2 Extraction:
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
sytareliar.xyz:80
yabelesatg.xyz:80
ceneimarck.xyz:80
188.130.139.12:23747
Unpacked files
SH256 hash:
b3dfd39fbd86b5473844d8e68bb08e24fce0778ac0ad83af44867d100ed6b9f3
MD5 hash:
57699197e5670c0f77d674d7818abbe6
SHA1 hash:
1b648548a7ce05ac6a62b0341e9ecbfff768dd03
Detections:
win_zloader_g1
Create hunting rule
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
Parent samples :
5befb90b9e363ee7a3c80607b83247dee8d21267f5923345119c07ac22f0bdef
3de698ac8b7a255a50e6f0ec0fc0cba3299719516a96f641a24d0996aa1515c2
4b5091f5530ef7e23a331115a0290cc3c368fe23e4e53b68d5d61ffddd27e793
415f9d7bdc9ea00d2c8e58d906cdd7af876e28494e24e027401b6be60144ddcc
7471e982051110160ecb8d1a95aa8ba5d8f3d61d341706232caf57c1b8b3ac88
79c334850dedad7a1eacb71789b4f025a307bb093f916b51939384a6593315d3
db724681d71bd9cc6d6272e1fb68e52509a453b16c6b2bf3cf3040b6169bb1e5
cdd97a4a8f04c6241bc2bc9fed6b43dfc4b08b8d96ffa91688df52c3f0b489a6
dad7611f8df2b970dad82657205886a8b314472c59927c9ba29a484e1376e157
9629761247d31f92dd76b67e98acb749b69572cb7198e05b3a2a2b1fa3a9bfaa
7a30562757837dadbb29871ae310dd344b0c422d14920d4c72a98fa820f5e9e2
2db2cc193feadebfc2a1847f97ba91070840b51cc9729a3208cf288afa71f19a
67315a8a56433109b3fd378798d9d9a0b5b7f31e8054e1dcb4c5e91eb596b495
0042db3f1d304c60dc3d50fb26fcc87cea1b8f2eb15132429588d3a0f4bae296
670eb3744d703bdf43a246ffbb313cecaf01f55feaa973a3f85bd8c4dae781c2
98fa2b33875a2409f9107832e7869bca91f44e57af1fc0743009c8eb53f0e928
8cd17893e8ac733bb4bf624e9351dcb0b08d83c3908385fba72fe72c70fd4f03
e48022e9f7c8d368e6f8d65c86f19afb98d1104dda8d06047acd1feff6a658d7
37550c63f7c27440149dcd0cefdc456f04422595679adebb3be0278249d145c6
b503aee98c27d8e15feb765addc1c386c7c59ccbd43ae7c4d2842b293120130b
3ad13fd7968f9574d2c822e579291c77a0c525991cfb785cbe6cdd500b737218
3221c7c857b80fab3818cf1ea9435cef9626d84bd308d7a365e4e5089e5ef413
67b1a7835687bf5851cf29539b2d0ce90ab30d373edfcf9ee54237026c67df33
8bb0c75f554647d27173b3d8b2e63abba3670fb7972b6856cbca89f1eda96c6d
21391fc51c85957fb1bf530fbdd01b9cc6b855445c5ae6e46d9be51441ee62f5
0b07fe8c554ff364d42e3311b10a79ba6ed1b47e35763e45c924bafeb8d0d50a
a8647cfb02a8b8c077fb4285357c29f58afb1a8ffff6da199e6a3887030869fd
4df83e858a2d52987f6e9b8afcde20643ee1cd106089e412e25b1df186a57b29
a4561c8115ba9a40d8ccc6411379e8db03ac8540c681b8aae63763a7e8c10a27
d6d3dd2923a9b46473abb1d811fb4b64bdcf2c0c15c1f48161353b1c220d7e23
bf5bc18439ee4363f861058f1dc8a0fa74775be6efc44fbf7d8d6c511fd2a447
cb7fc22f3b5ccf76238049bd7388f760204728fe846742fbda3560b1085efa7f
cf46c5f2cd03626cad846f9d3d55366a7b469704eae8ed7ba54eda6940dc9bba
a7a2d5e0d31d31e452252c14023420621e92967814dc6410f783c5f101c3de1b
41ce43aa875bf977ec9eb039e5853ade1af522dd0dff4f19282f6c8038ae2dff
39326cdd0c863e1766ecc3d119ec18fdaa93ef886cfbc887f76784f745df73e4
d824b099e911bc138c15e82996288b84253e98e2f2b286801edc564ff98e7bf5
db9c79df5fa9185f4f1d4745cdc8c417d21679d4bfd7dc7d5939312024d92127
d2f01f5182de940b27db63f60ca85d5f4421c75de628c03a63d8e92cf9f3681c
055581a45098bcdda89f414c2346c7737546908ad7fba54f1c6f6451886e014d
30471f6f937611ff3868013eccd4b8fd33150e7bd0c25e49bc1ae53c2f3ad78a
4024acf12f12a1ef676b1edd835a5e384d4800725c352c1e88b9c94b94293e72
7edd23716ea559a786a78a1637749a4dd626c79f7119fd128e43334dafa1dceb
d57957436111516ca7a7e9af7cb143353cf41a22d556aa19ba6e710a37c6f0ae
f421b369da1548568f6d2edc332073ef7604517e83eb1425f9b336eb56e6ce7a
b5f88e34db4bb65da8c21982590b67922fe32e62e7cfaae9fbe417a4262aa143
8eea00bd7d1db820c7a1b5622119b76944215e5803c2e8b772b9548e9ee91c66
b39e29c24003441609c457a3455cae9d9fb6f4462f5e06d0c1d317d243711cb8
203a03884451e5f74fa167f4708e19722f1d91ba434957aac1ba13f1a3d70127
8980c8abaa3365782c905b3f9506a032c54a5d1833fef1fe0ce46b6f84ee7534
049305763188b36e9010906c55428a2b42b59da7da4e0709112835a46c600243
58a7195eaf6e6d8c366dd038689da7697e0acfc5d0d160fb89d63f1658e997b8
ce16fc8b907646744f5790fa16e1bba6b1b3c3484a7c9d3802193d7c518c1f08
d64cda4b27aee29a8f491b125d83bc8b55d483db8884b14fc1a3ef20fe1717eb
13b76d70cecc082e06783f4a67c8c3b9cd5e4fb652e22475e9e11440b7a215cd
d179e667e2790673f30e69bebaa0bcd4d4b9bf68503611b6d26b278447cd4ae1
d86aa13697e550f6e74a585167e0e5aae455a7a99284679f230fe1d96ff59d8a
07a3740166cef528ebddd4f594c555f7a07cee5260fb85d2840dded9ebbbd652
50ab699ceb6bb259199d197392ea0ed00d024ce77d3d663ea13fe7b93a4ab50e
769a9ae9ab253e8cce64c35143eff02b2ae70e53465ab4aa4f6cf1b2d4fe698e
b01b61c911a3b80d4f265e4915f9d62275efa34f84989f77be142f3f9e062f9b
1c74706b3f7dc817e51a166a5e41e55383347e1080a3b2aa41b9f6dd87d63040
56538d4161a6b6e0e57759f73f81a76db0b7bf9f923791f56e719793ae10ece9
2cc5f31570047becc5e77581e2f640afba8d6904c6be61105603d60d01c181d0
fff25302774366cdb466fa0e4015f9c7de93fd0192585a3cab2e2f51b635047c
935099f2160f2dd5fec6a63ea02c81d80c0b2cbf712b0e48b386a81078a627dd
c9371cc485825207fe107e6600c14cfd9049c34f74c8c7332f16a20afea88164
962793c4decea8dd718bd96ccc4209ce744414a62e4afb93c79db64df4b792e2
SH256 hash:
8d063d3aef4de69722e7dd08b9bda5fdf20da6d80a157d3f07fa0c3d5407e49d
MD5 hash:
559948db5816ae7ab26eb2eb533887ed
SHA1 hash:
e60442c6fb35239d298b01b0f4558264c01b2e7f
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
MD5 hash:
1c7be730bdc4833afb7117d48c3fd513
SHA1 hash:
dc7e38cfe2ae4a117922306aead5a7544af646b8
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
4d4ad145431ee356221914f2908ff9b4a4a56f90b9409ec752f7be1a978e7435
MD5 hash:
ae7c477ce9bd98d13ccff5fc4a0d190e
SHA1 hash:
249ff902f66c3d0cee6656802b14a9c34807bc8f
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
1541d21a7278277c1e24d483fc5761cd9efb3546d5c1d45df9461f6513152ac5
MD5 hash:
f06595a1d36f5e6b82d36b42bb8fbf24
SHA1 hash:
a54bdb0d2e1632c7ce3ef20ad5f6f50490574c76
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
0511c57c737a72d6490e08366fffa65da3da16848b101c27dc777922440b8c15
MD5 hash:
47514ea4920181f38bea637a358ef2c9
SHA1 hash:
7fc91695bb4492de250651d54dcf10413adb48e0
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
c3b8df117970ab5ad7d3174779116845eb3f9ea9060cf72d125d1cbc31e3a95d
MD5 hash:
5b067f3918279c059c08663f50c30d8c
SHA1 hash:
4d399962a309cff3ae69db0254697c0b4ea9cd8a
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
21a27c1c007206117edc2618bb834fa31d07f0aa0fe15ef0171e90ec70733017
MD5 hash:
71a8b425237ed53182cebb5dbc841332
SHA1 hash:
4220c9de6b28f499a8e37818e3a1118ca49ed509
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
b9cefc04996e89e4b573c98044588940b374b239aeeeb990f3cdd3af8d3bb61b
MD5 hash:
cda72c1384b147c05fc1202f6c832aaa
SHA1 hash:
7872becf22ddd5d7ed544be243bb6f4c884d53da
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
cd02f8a729ebb5d8084ffa52da596ac204e43e3fa3e4c98f3a802c17ce11a32a
MD5 hash:
550da99385f08dd67fbace9d8f7153ac
SHA1 hash:
e3a6bb7eb961fc2791d7e8bbe37968ecfcba17fb
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
2e441ede019a697c3323ddd664e2db1df1624905e1be74990a5d35e7a56d59c3
MD5 hash:
d62c682fce386f54b12b50778380ecc8
SHA1 hash:
b1ff61a72058966ed1c1af72de94787028859b00
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
35d8fd163218acc161c9492774954680c53c90ea50a6d1ec360b6103b958e6fc
MD5 hash:
2a4c7bdb753c0b97c98854c6f4a4aa6d
SHA1 hash:
4cffe6c7cd40600bd381af2a321d26d00a704243
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
7228f07906ec74f9bc65333f4dbf3b11a653557f4a570fed9f9ce2f9203287a5
MD5 hash:
48d3626f858243860b2584aace89adb2
SHA1 hash:
f7fca45c297c0c15d449ccd62bd794785dfe1533
Detections:
win_socelars_auto
Create hunting rule
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
Parent samples :
67b1a7835687bf5851cf29539b2d0ce90ab30d373edfcf9ee54237026c67df33
8eea00bd7d1db820c7a1b5622119b76944215e5803c2e8b772b9548e9ee91c66
SH256 hash:
283ee0c2744e32eab4b0f96bc2ef62e4f5ab024695eedc71c91b1ed0c2ab267c
MD5 hash:
a349f3691527d6bff9173c21d8cf019d
SHA1 hash:
18ad20f0325280dc53619a72fa43a0be7a7e4a76
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
cabe5b211fbcdd30149201df427abd373e8d79c7db20cdd701df088c918e30ac
MD5 hash:
afd675b8336e829c5a63738ba6d3a761
SHA1 hash:
9fa78d50e52d10d1763e620d8879dcb3b77c333c
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
e31c9bbd0aa8d1aec1ade0a267ba152b1e5a019581aab8d6f20ca04c7fe4ecb2
MD5 hash:
a25c735d2261ad56dc3feff4a5f0daab
SHA1 hash:
3266b2f49d1b35a7c1f5a036fb90385b8fa30c3c
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
73aa3cf43e360726600ca6353068e12e61bf0dab9dc43b62cacf4b6f83229df6
MD5 hash:
856f045777cfceafb26e723bbc7b5b2b
SHA1 hash:
a3e1e091bba35282732d22a9f63c64d2d6d1e018
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
SH256 hash:
8eea00bd7d1db820c7a1b5622119b76944215e5803c2e8b772b9548e9ee91c66
MD5 hash:
de84761745481d3020af18fc0c3eef6e
SHA1 hash:
99d980acadd231db0ec5cc73d39ee6e229a22475
Link:
https://www.unpac.me/results/54b8d0ba-49be-4281-af42-142755e9d68c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8eea00bd7d1d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8eea00bd7d1db820c7a1b5622119b76944215e5803c2e8b772b9548e9ee91c66

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:pe_imphash
Create hunting rule
Rule name:RedLine
Create hunting rule
Author:@bartblaze
Description:Identifies RedLine stealer.
Rule name:redline_new_bin
Create hunting rule
Author:James_inthe_box
Description:Redline stealer
Reference:https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:RedOctoberPluginCollectInfo
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/179406/

Comments