MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8eeb37060519ca06889e09113bb423bfbe8c2e16c93fa5b75d82397f8cf58012. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8eeb37060519ca06889e09113bb423bfbe8c2e16c93fa5b75d82397f8cf58012
SHA3-384 hash: 4dbcf8df510dc9feddc2b0e237b50d2eeff2bc5b2a4cf3d42ef51fa792498a6c529ad54b9c9c5b37375b0d5154e4643f
SHA1 hash: 2aa18f7676d80ba86223c4df8966513bf6430149
MD5 hash: cba0e7debb118110852f7f2b1f0c9c2a
humanhash: mars-butter-video-king
File name:8eeb37060519ca06889e09113bb423bfbe8c2e16c93fa5b75d82397f8cf58012
Download: download sample
File size:13'033'847 bytes
First seen:2022-03-23 12:42:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 51a5e6ba413b3d4c2f9ffde72d1f2a95 (2 x ZuoRAT)
ssdeep 196608:hnhelAG6ZuXahOBXn/RNrlHAjoG+IMmvdsCncNgomn9VHGD2rSqmbmC+q0iYF4HC:9helCVCZxlHOF9vaCncNH07msmbf+qs
Threatray 1'507 similar samples on MalwareBazaar
TLSH T1C4D6333C1BE008AFE6E65F369C52C679D9B4F5A41716C12F4358A1FA3F27BE06923910
File icon (PE):PE icon
dhash icon f3a3b9fadf96be5c
Reporter struppigel
Tags:DiscordTokenStealer exe Plague pyinstaller Python


Avatar
struppigel
Plague Python3 Discord Token Stealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Detection:
PyInstaller
Create hunting rule
Link:
https://www.capesandbox.com/analysis/256598/
Detection(s):
SecuriteInfo.com.ArtemisCBA0E7DEBB11.15907.1967.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Launching a process
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
expand.exe greyware overlay packed
Link:
https://www.filescan.io/uploads/623b1630dfdfa8501cd2fc3a/reports/462bf297-5983-4ba0-8dfa-ba02296ee5c5/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/963371
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 595853 Sample: N0feIoyW43 Startdate: 24/03/2022 Architecture: WINDOWS Score: 48 33 Multi AV Scanner detection for submitted file 2->33 8 N0feIoyW43.exe 135 2->8         started        process3 file4 25 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 8->25 dropped 27 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32+ 8->27 dropped 29 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 8->29 dropped 31 64 other files (none is malicious) 8->31 dropped 11 N0feIoyW43.exe 1 8->11         started        13 conhost.exe 8->13         started        process5 process6 15 cmd.exe 1 11->15         started        17 cmd.exe 1 11->17         started        19 cmd.exe 1 11->19         started        21 41 other processes 11->21 process7 23 mode.com 1 15->23         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8eeb37060519ca06889e09113bb423bfbe8c2e16c93fa5b75d82397f8cf58012/
Threat name:
Win64.Infostealer.Disco
Create hunting rule
Status:
Malicious
First seen:
2022-03-23 03:00:31 UTC
File Type:
PE+ (Exe)
Extracted files:
760
AV detection:
5 of 42 (11.90%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
04a31ae8a31bb4144d7392040442f4a38e8301cc550124cc47d012a0eba71bdd
3d0ca4604a0effdd7d12700991d223fc96ea02b49531fcea2e4e4d3db521e9b2
4e7105da7face5917f66842ba73810d29826cb971140f9da2b0efb7a37de3c0e
5c718efeb3b955290112362f4d95e2e5f9c32080d14de40106cae9f42a796d52
5e0eb79c69c7e3e88abf119505ee648f0980b190da91620e77e2bde0d892223d
bbaf8ed986b67aa0b15e3b880bc2943554ab0da471291c9dd1b24a96d7b1a124
cd55506ba70b766f436a1dd02dcedb800dc5eeab058de438a2da134e4ec9d466
cdd0d34714297037b5be052585421821a6c30d48866394ea0bb8c1a7f29a9195
d6c39d7d9be421b66517d195180f7156c52c3fadba440d5d3d26ff6b1d45aa1a
f756e9d3a61e888f55528616f049bb38c67fbd2706ee850ee26061c25b8677fc
+ 1'497 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/220323-px215safej/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Unpacked files
SH256 hash:
8eeb37060519ca06889e09113bb423bfbe8c2e16c93fa5b75d82397f8cf58012
MD5 hash:
cba0e7debb118110852f7f2b1f0c9c2a
SHA1 hash:
2aa18f7676d80ba86223c4df8966513bf6430149
Link:
https://www.unpac.me/results/9063ce6d-a8a2-47d7-ac2e-ff44d22e8dc2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8eeb37060519ca06889e09113bb423bfbe8c2e16c93fa5b75d82397f8cf58012

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/256598/

Comments