MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91aaaa1b0672caace5865b8c42da45a0efafe4dc373d9e1999e9411e31be17d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91aaaa1b0672caace5865b8c42da45a0efafe4dc373d9e1999e9411e31be17d1
SHA3-384 hash: bb9b207c76fd5e57f8d832a3417fd7ca3cc6d5c1f6777635f11c052e1cbd30daab2bb705f332e403068f845d6ce3bd0d
SHA1 hash: 10953267f68e8819b8e38b3a1682f6b2e6937fd9
MD5 hash: 3a3d6ebf27d6b111a5cd3da243d23844
humanhash: neptune-sixteen-william-iowa
File name:1.exe
Download: download sample
File size:1'529'856 bytes
First seen:2022-12-10 12:41:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9cbefe68f395e67356e2a5d8d1b285c0 (58 x LummaStealer, 49 x AuroraStealer, 36 x Vidar)
ssdeep 24576:qvL+8rMAks3Jx5Crb/TJvO90d7HjmAFd4A64nsfJAy3rUgvN6R6+z1:qT+2Mo3Jx5Crb/TJvO90d7HjmAFd4A6c
Threatray 27 similar samples on MalwareBazaar
TLSH T1D3652847BC9090B6D4AAD2718A6692E17A30BC980B3123D73B11B7FD2F767D46E39314
gimphash 48854d05df30a3cbce77f4096800f98f8ebda583bab6380dba8c508753d1dc79
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter Anonymous
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
JP JP
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/344989/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
golang greyware
Link:
https://www.filescan.io/uploads/63947e9ed4d7598ad904fdb9/reports/266c3340-fd0e-4ee4-8bb4-755aa44da538/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
ngrok-server
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/840f2961-2dff-4848-845d-f23297af6d73
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1131942
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 764666 Sample: 1.exe Startdate: 10/12/2022 Architecture: WINDOWS Score: 56 11 Multi AV Scanner detection for submitted file 2->11 13 Machine Learning detection for sample 2->13 6 1.exe 1 2->6         started        process3 signatures4 15 Potentially malicious time measurement code found 6->15 9 conhost.exe 6->9         started        process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/91aaaa1b0672caace5865b8c42da45a0efafe4dc373d9e1999e9411e31be17d1/
Threat name:
Win64.Trojan.Tedy
Create hunting rule
Status:
Malicious
First seen:
2022-12-01 00:01:15 UTC
File Type:
PE+ (Exe)
AV detection:
6 of 41 (14.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sgvkugygolfkzzmglogefwsfudx27zg4g46z4gmz5far4mn6c7iq._file
Verdict:
malicious
Similar samples:
5334c9a9792df13c2ff710ec7d1989c19b04bbd623c55a221c432dd94628dade
7210e765a1076443d68f12d79b3eea55f3dbabfcb410a6cbfb40d4ee546d9df9
bbcb82bc235ec39c98730b134d628d93134b2e17fb4b746765989480d414aa64
c3735cd5a9ac84207e24e1d7cadf61766307f31d9f91fa9b63013d91af435fe1
cdc9f6db38735ea160b075611a5ff62fdfe572f543a59f5170856e067fbf5112
dbc947a5e1eb6a84e3224e6a1a05969c87cc596f86eae1078d4d9200efded647
e9b29df96b107114bac6ebb4f5ead3398f815598493e70cf70250c4fb48dc097
f6238ae2550a457d7397da52826738981ed3486ac9df94fac77996cfa294eb09
+ 17 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/221210-pxcq9afe69/
Behaviour
Drops desktop.ini file(s)
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/85e9a750-c5cf-44d9-8ed0-83f8dcdb0eea
Unpacked files
SH256 hash:
91aaaa1b0672caace5865b8c42da45a0efafe4dc373d9e1999e9411e31be17d1
MD5 hash:
3a3d6ebf27d6b111a5cd3da243d23844
SHA1 hash:
10953267f68e8819b8e38b3a1682f6b2e6937fd9
Link:
https://www.unpac.me/results/479fb081-3b79-4b63-afb2-b524635aa29a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/91aaaa1b0672caace5865b8c42da45a0efafe4dc373d9e1999e9411e31be17d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_bin
Create hunting rule
Author:Jonathan Cole
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_build_id_strings
Create hunting rule
Author:Jonathan Cole
Description:Matches on string Golang build ID
Rule name:go_binary
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/344989/

Comments