MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92b4f87f9ef64d1b37a657742438e136f72434dde1b8d30865e419534fdd8260. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	92b4f87f9ef64d1b37a657742438e136f72434dde1b8d30865e419534fdd8260
SHA3-384 hash:	fa835da0f00fc246789fd6cf64401de04114785741c4f3dd1400362515ba73eb19a0ba5bf4213a5ac2311e8c0e588bcd
SHA1 hash:	07463a22036c6ed6395812d0abfb04beb7176528
MD5 hash:	969dee897ac1d3e02c34bd4e052511da
humanhash:	november-lima-red-robin
File name:	969dee897ac1d3e02c34bd4e052511da.exe
Download:	download sample
File size:	1'840'139 bytes
First seen:	2023-07-04 07:26:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0ae9e38912ff6bd742a1b9e5c003576a (10 x DCRat, 7 x RedLineStealer, 4 x AsyncRAT)
ssdeep	49152:HdgSptwWYRFGWjAemdi/kRaIIDFKmZg7Z2Bd2WB:HDLYCTi/kRavN0Zid2WB
Threatray	569 similar samples on MalwareBazaar
TLSH	T1988523017AC488B2D16318335976BB20997CBC316F76DADB9384355C9E722C1EA3277B
TrID	89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.5% (.EXE) Win64 Executable (generic) (10523/12/4) 2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	abuse_ch
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

274

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

969dee897ac1d3e02c34bd4e052511da.exe

Verdict:

Malicious activity

Analysis date:

2023-07-04 07:29:10 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/474c98b6-dd3d-4d7e-a889-17d35da2a0c6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/406295/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Uztuby.4.23664.31325.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Launching a process

Sending a custom TCP request

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/95480/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-vm greyware lolbin lolbin msiexec overlay packed packed replace setupapi shdocvw shell32

Link:

https://www.filescan.io/uploads/64a3c9c82299d26882649a0c/reports/4aab3131-9e2c-44ef-a408-bd285d149c12/overview

Hybrid Analysis Trojan.Uztuby

Verdict:

Malicious

Labled as:

Trojan.Uztuby

Link:

https://www.hybrid-analysis.com/sample/92b4f87f9ef64d1b37a657742438e136f72434dde1b8d30865e419534fdd8260

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/78bb075e-81ab-482f-ac99-ac8d54785bd6

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1266422

Signature

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/92b4f87f9ef64d1b37a657742438e136f72434dde1b8d30865e419534fdd8260/

ReversingLabs TitaniumCloud Win32.Trojan.Uztuby

Threat name:

Win32.Trojan.Uztuby

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-04 07:27:06 UTC

File Type:

PE (Exe)

Extracted files:

18

AV detection:

13 of 37 (35.14%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sk2pq7466zgrwn5gk52ciohbg33sing54g4ngcdf4qmvgt65qjqa._file

Threatray malicious

Verdict:

malicious

Similar samples:

30f91a9f411187ee24ea1a19d9043c4065707e7c6754c96a8c7ad1fb18ce0d67

33e686777d4e60947c1bc7d7743f006901dd209ae7fa9c6bd3d758dfc9b0aafc

35e5460c102ca2f996d61d70d6bb06fb87014f7d2beccf35f3812ea534acd9d5

36194d07ea9897f2276215a1361291ba8e32843caf3056b4f096c213b1bfadb3

3f64e635a811969032be1c3bd6d467b6edae118ea00996a66e56e9d798a4db03

7eb0ebc81444d77b62e03f1757763740d77009bd53a01ef19ce66e4dfe9bff77

8525d0bc1e38bb74d592de9be2615da94ec0b81e611b0e456b3a51c40ab5baa3

a040c35ef32cbe289d5bc2b8014adcb961ab3aed1e2873d1f2e335933e97927b

e905f262f2ec981ddf92c94fe44d96c14195f9bf0815f204c2c4197b16dbb053

+ 559 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230704-h931msbe49/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

46b6626ca926682a2f467b8667f9e8b2503719c9508929dabe2a5e86f6c0493c

MD5 hash:

5f5422950169010e88a01e8eb6ecc236

SHA1 hash:

77812737ff80c40a0f7deb1a1f6a6fe497d1cf46

Link:

https://www.unpac.me/results/61416ea9-9a32-4230-b5c3-090540e51c17/

SH256 hash:

92b4f87f9ef64d1b37a657742438e136f72434dde1b8d30865e419534fdd8260

MD5 hash:

969dee897ac1d3e02c34bd4e052511da

SHA1 hash:

07463a22036c6ed6395812d0abfb04beb7176528

Link:

https://www.unpac.me/results/61416ea9-9a32-4230-b5c3-090540e51c17/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 92b4f87f9ef64d1b37a657742438e136f72434dde1b8d30865e419534fdd8260

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2675870/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/406295/