MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f24ecaab6d8e19c35e62081283596e1fa5db84c9adefb63a9e7a3d732092ee9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f24ecaab6d8e19c35e62081283596e1fa5db84c9adefb63a9e7a3d732092ee9
SHA3-384 hash: 8e7223edc98b26c19ba2d3f0b438291a3f02e1ead30bf214eac1b36f1517f2ad54ff70b2e85562c8e3903ecf964cea4f
SHA1 hash: dd0c4a670893a1b6e0b443726a6ffa43f38445d6
MD5 hash: 53140c73abcc1de4db9abc54fb8ca682
humanhash: zebra-blue-mobile-single
File name:Trojan.Win32.Genome.amxxx-8f24ecaab6d8e19c35e62081283596e1fa5db84c9adefb63a9e7a3d732092ee9
Download: download sample
File size:1'819'104 bytes
First seen:2022-08-31 04:25:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5be0dd95dfb859710bb0eb948f0c0364
ssdeep 49152:4jKlba/hKlxPT2jO4Zx3xjEaEL2O7DTYtq4c5dcDeE36N:4jKvCjOqbQa1O7DTgq4cLcqE36N
TLSH T18F85F132B6D08833D03319385D5B97B9A83ABE102E39B9877FE51D4C1F3969139262D7
TrID 38.0% (.EXE) InstallShield setup (43053/19/16)
12.5% (.EXE) Win32 Executable Delphi generic (14182/79/4)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.3% (.EXE) Win64 Executable (generic) (10523/12/4)
8.8% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
File icon (PE):PE icon
dhash icon 92e0b496a6cada72 (12 x RedLineStealer, 7 x RaccoonStealer, 5 x BlankGrabber)
Reporter OSimao
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/306573/
Detection(s):
PUA.Win.Packer.Exe-6
Create hunting rule

SecuriteInfo.com.PUA.exe-with-encryptedzip.UNOFFICIAL
Create hunting rule

Win.Trojan.Dropper-2051
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the %temp% subdirectories
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
67%
Tags:
greyware keylogger overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/630ee36cfbf1afa4927ae1ef/reports/c69fd531-77bc-4b94-b265-e6a086a67ede/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1061214
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f24ecaab6d8e19c35e62081283596e1fa5db84c9adefb63a9e7a3d732092ee9/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2011-11-18 21:07:00 UTC
File Type:
PE (Exe)
Extracted files:
95
AV detection:
20 of 25 (80.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r4sozkvw3dqzynpgecasqnmw4h5f3ocmtlppwy5j46r5omqjf3uq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220831-e2hsysadg5/
Behaviour
Runs net.exe
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
8f24ecaab6d8e19c35e62081283596e1fa5db84c9adefb63a9e7a3d732092ee9
MD5 hash:
53140c73abcc1de4db9abc54fb8ca682
SHA1 hash:
dd0c4a670893a1b6e0b443726a6ffa43f38445d6
Link:
https://www.unpac.me/results/c72e9450-5180-4447-937d-c3e64fa9aee7/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/306573/

Comments