MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9274735c05b32c7682323b61494b4190350689c4b55d240a02c1d4341c915c55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9274735c05b32c7682323b61494b4190350689c4b55d240a02c1d4341c915c55
SHA3-384 hash: 763c2662c1c6c310989bac7e17736e5edbfaf73a34cf8dc19b97f14e62347f874407c72a49a64d44a770485140b3b0c4
SHA1 hash: 8fddfef2b4c6ec3c849f4aba7067599be2623f79
MD5 hash: ebd0dbdab04e64c56d634346fe64e9d0
humanhash: charlie-echo-red-oregon
File name:1688809447a514c104823d768d0dbdb8aa1b44a2aa1358b38e44b9d575afb9c198a37aa868801.dat-decoded
Download: download sample
File size:3'252'224 bytes
First seen:2023-07-08 09:44:09 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 49152:30U1nZuLdCy/j+luoEX+5qvLNZurzQ/IVr+KjHwNz0y:3JuLRiLoLNovQmr+EQdr
Threatray 53 similar samples on MalwareBazaar
TLSH T11AE5AE09BADAEEBBD3D46B3D601345285631E2063797BB2F1B7D09353D923740A423DA
TrID 80.3% (.DLL) Generic .NET DLL/Assembly (236632/4/32)
4.4% (.SCR) Windows screen saver (13097/50/3)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
3.3% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Reporter abuse_ch
Tags:base64-decoded dll


Avatar
abuse_ch
Malware dropped as base64 encoded payload

Intelligence

File Origin
# of uploads :
1
# of downloads :
273
Origin country :
DE DE
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/411725/
Detection(s):
SecuriteInfo.com.Variant.Zusy.472162.8457.14240.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm packed
Link:
https://www.filescan.io/uploads/64a93026d0e54b152c5a7ffa/reports/ae03d4c5-5357-4e0f-8bbc-0df41e19528c/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/9274735c05b32c7682323b61494b4190350689c4b55d240a02c1d4341c915c55
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f311ba1d-48ee-4e9c-a982-ceec95e08765
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9274735c05b32c7682323b61494b4190350689c4b55d240a02c1d4341c915c55/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2023-07-08 09:45:10 UTC
File Type:
PE (.Net Dll)
Extracted files:
4
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sj2hgxafwmwhnarshnquss2bsa2qncoewvosicqcyhkdiherlrkq._file
Verdict:
malicious
Similar samples:
2184033d7ec56ba7ace3dcb48d10e47874a638d8a7c01e0ed321c79d2e9e576f
5191f253dac6048e343a1c5a9503ce9efe250b04e333f0f7c216bc9294ac8183
7474c59e2ced7b554bc03a190b33690f640a8f415b38fe21e2caa0a7a33215c9
8cfab1a4c573103b5b39aed0c2cb8fbcd76d246d7bc106fd0ad1fa6adeff91b9
8e7fbeb2dd4fecea39d5194595357509c3d9a0bdfd5d8f962815f97090e9c831
91bedde298120f2112051018910a77a8672687917722e9a4aba692ec312bf4b2
abe25695b67fcf9e07c535f4f8664a2828fbef735821337603a451475b7976da
dc52c71f9a686ecba5993f0c7a183f0ed86f588bdc75490f24a4b5f61339995b
ef4930b5b0a30a1cc493f4b7f72fcadcd109d21956d2aced6e85e4c6f5e69fb0
f275589bf659f7805e2be779ef77334af3e914e57530c5bf241c8de6e22c6225
+ 43 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230708-lq26saeg4z/
Unpacked files
SH256 hash:
9274735c05b32c7682323b61494b4190350689c4b55d240a02c1d4341c915c55
MD5 hash:
ebd0dbdab04e64c56d634346fe64e9d0
SHA1 hash:
8fddfef2b4c6ec3c849f4aba7067599be2623f79
Link:
https://www.unpac.me/results/735af41f-0fc1-475c-9cb9-297ce0031afc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9274735c05b32c7682323b61494b4190350689c4b55d240a02c1d4341c915c55

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

unknown a514c104823d768d0dbdb8aa1b44a2aa1358b38e44b9d575afb9c198a37aa868

DLL dll 9274735c05b32c7682323b61494b4190350689c4b55d240a02c1d4341c915c55

(this sample)

  
Dropped by
SHA256 a514c104823d768d0dbdb8aa1b44a2aa1358b38e44b9d575afb9c198a37aa868
  
Dropped by
MD5 9853f5795a6df70069e48ce4b5f1c503
  
URLhaus
https://urlhaus.abuse.ch/url/2678625/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/411725/

Comments