MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93320dc79416b00e3e78f70e316e4f6d35eb99360b305a706582b845953e1f62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93320dc79416b00e3e78f70e316e4f6d35eb99360b305a706582b845953e1f62
SHA3-384 hash: 8dd121d852cbd18d5002b239ba251f91746822ef05cc9bae77b71283c124c9c73d6f200eb25ac1f5d46494c44cfb8c3b
SHA1 hash: 5c14c17b4bbdce38b51669c0b1ae69d23fc453c1
MD5 hash: 50dad4adf51cd79103eb8f3e7c51793c
humanhash: grey-seven-hydrogen-social
File name:50dad4adf51cd79103eb8f3e7c51793c.exe
Download: download sample
File size:1'206'830 bytes
First seen:2021-07-12 09:14:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be41bf7b8cc010b614bd36bbca606973 (195 x LummaStealer, 126 x DanaBot, 63 x Vidar)
ssdeep 24576:Hpd1ZDin6iS/i7yUKu9D5qNrQO6pu2khmd6g44k7NXlw+aVgKQ:T1ZDieiLDW/6pikP4xJltUQ
Threatray 344 similar samples on MalwareBazaar
TLSH T1CE4523C33A898425F7B21D751D74E36381B878E58D24C35F634279DE7A23828AF6436B
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/171022/
Detection(s):
Win.Packed.Filerepmalware-9864117-0
Create hunting rule

Win.Packed.Stop-9872858-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
IntelRapid
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fcb436df-5e0b-42b8-a129-172b0c9b7f72
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/814668
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to register a low level keyboard hook
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Obfuscated command line found
Sigma detected: WScript or CScript Dropper
Submitted sample is a known malware sample
System process connects to network (likely due to code injection or exploit)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Clipboard Hijacker
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 447081 Sample: yy5eC9e5Xp.exe Startdate: 12/07/2021 Architecture: WINDOWS Score: 100 76 Found malware configuration 2->76 78 Antivirus / Scanner detection for submitted sample 2->78 80 Multi AV Scanner detection for dropped file 2->80 82 8 other signatures 2->82 11 yy5eC9e5Xp.exe 25 2->11         started        14 SmartClock.exe 2->14         started        16 SmartClock.exe 2->16         started        process3 file4 54 C:\Users\user\AppData\Local\Temp\...\vpn.exe, PE32 11->54 dropped 56 C:\Users\user\AppData\Local\Temp\...\4.exe, PE32 11->56 dropped 58 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 11->58 dropped 60 3 other files (none is malicious) 11->60 dropped 18 vpn.exe 7 11->18         started        20 4.exe 4 11->20         started        process5 file6 23 cmd.exe 1 18->23         started        50 C:\Users\user\AppData\...\SmartClock.exe, PE32 20->50 dropped 26 SmartClock.exe 20->26         started        process7 signatures8 84 Submitted sample is a known malware sample 23->84 86 Obfuscated command line found 23->86 88 Uses ping.exe to sleep 23->88 90 Uses ping.exe to check the status of other devices and networks 23->90 28 cmd.exe 3 23->28         started        31 conhost.exe 23->31         started        process9 signatures10 92 Obfuscated command line found 28->92 94 Uses ping.exe to sleep 28->94 33 Vigilanza.exe.com 28->33         started        36 PING.EXE 1 28->36         started        39 findstr.exe 1 28->39         started        process11 dnsIp12 74 May check the online IP address of the machine 33->74 42 Vigilanza.exe.com 3 19 33->42         started        64 127.0.0.1 unknown unknown 36->64 52 C:\Users\user\AppData\...\Vigilanza.exe.com, Targa 39->52 dropped file13 signatures14 process15 dnsIp16 66 ip-api.com 208.95.112.1, 49730, 80 TUT-ASUS United States 42->66 68 192.168.2.1 unknown unknown 42->68 70 HuzkESWqLFmEcD.HuzkESWqLFmEcD 42->70 62 C:\Users\user\AppData\...\temaviqecqs.vbs, ASCII 42->62 dropped 46 wscript.exe 12 42->46         started        file17 process18 dnsIp19 72 iplogger.org 88.99.66.31, 443, 49731 HETZNER-ASDE Germany 46->72 96 System process connects to network (likely due to code injection or exploit) 46->96 98 May check the online IP address of the machine 46->98 signatures20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93320dc79416b00e3e78f70e316e4f6d35eb99360b305a706582b845953e1f62/
Threat name:
Win32.Trojan.Crypzip
Create hunting rule
Status:
Malicious
First seen:
2021-07-12 09:12:18 UTC
AV detection:
21 of 46 (45.65%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1913b57379e19d7d05f7a55160343d7d081fe01c668b0652097311a0e9f57940
6e3bf07d961efc686017f48cf2f847072cb35699dc24e44287d9e01274814ad4
7304be70f4e18d91047e2ee07944ac60dd018f35cc4321634b160e0ca39c28d4
7525f2c1ccec025adb8f773ab10ecd9cee7bacec9949a7415ad239cec969bfb8
78917f8c2ce40501bb4bf955f14e9f96dea7aa003bc6d21611d6c771a7df6a16
7c3ec59724f79c69f7bb889f8dac9e89a45ad3629a25c954c26905b5b953e3f5
834ccdd87931ab88f011372377befbafda51abccff557c7dd3e01682580716fb
c10f974322f23a93c0354a3f57151b3017620313f5678310db27d05be10b4e98
e5dae08e748e408a4a256bd0c5d216281596a20399ea0127ac35b1661248b3ea
f2a7cc00ce9933490e51df2d5df9e7b0b2165c73297a9fa8a99fbf51b85926b8
+ 334 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210712-nen299j31s/
Behaviour
Checks processor information in registry
Modifies registry class
Modifies system certificate store
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Unpacked files
SH256 hash:
b37995e1a07b7912e8a3f15f8ae3fdba1dd3f991c6a609b625f74e020f21df27
MD5 hash:
3fedba8e09bedb89012510f6c6458b32
SHA1 hash:
00d10810047574a9afd88f151da9b2e7105b1a27
Link:
https://www.unpac.me/results/fbe9a2be-4517-42a8-b0fd-c3c913f912ca/
SH256 hash:
baf9ec22ae27dc1a8c63dacd78bdf0487e4faaffcb6ac289254cdb83d504e40c
MD5 hash:
d6bee51771e5ed570cd871a3838c345a
SHA1 hash:
b96b39f35ba7901f1fb1b6a3e9822bca690f7796
Link:
https://www.unpac.me/results/fbe9a2be-4517-42a8-b0fd-c3c913f912ca/
SH256 hash:
cae2af36f866fed9753ecc423bf1cfb3d1b5f2c3179dddc1715d6c896812d669
MD5 hash:
0fcc3d7408dfb7b31d8e36982dab298c
SHA1 hash:
6ebe13e8565ab5cfc7f8eac8973c156531b2a1e2
Link:
https://www.unpac.me/results/fbe9a2be-4517-42a8-b0fd-c3c913f912ca/
SH256 hash:
93320dc79416b00e3e78f70e316e4f6d35eb99360b305a706582b845953e1f62
MD5 hash:
50dad4adf51cd79103eb8f3e7c51793c
SHA1 hash:
5c14c17b4bbdce38b51669c0b1ae69d23fc453c1
Link:
https://www.unpac.me/results/fbe9a2be-4517-42a8-b0fd-c3c913f912ca/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/93320dc79416b00e3e78f70e316e4f6d35eb99360b305a706582b845953e1f62

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 93320dc79416b00e3e78f70e316e4f6d35eb99360b305a706582b845953e1f62

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/171022/
  
URLhaus
https://urlhaus.abuse.ch/url/1447146/
  
Delivery method
Distributed via web download

Comments