MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93cdf41efa17cd5adac34ef959cadbd1edf13275fad4804303a0ee67959fc8ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	93cdf41efa17cd5adac34ef959cadbd1edf13275fad4804303a0ee67959fc8ca
SHA3-384 hash:	ac541b26f1d5dadfdd2ccb3f03648f67d4370b2c4c4fd0805178b6659d4ee8db64ec8799395167d01d2bd7379c141a02
SHA1 hash:	f963d84bf8258d8cd9ce7e64261b43052d45389d
MD5 hash:	46c20cfca7c996514a48fed3f419fb86
humanhash:	solar-earth-queen-carpet
File name:	SecuriteInfo.com.Win64.PWSX-gen.24227.21513
Download:	download sample
File size:	192'512 bytes
First seen:	2023-08-17 23:38:30 UTC
Last seen:	2023-08-18 09:06:33 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	3072:Mnurs1PIjL/zdzi9zLDMxMn6ScGpr7RmZjko0:LiIjLx6X+O6lGpr9sx
Threatray	791 similar samples on MalwareBazaar
TLSH	T1C214A407B55ECEB2C6951336C6D7020877E3DE82A793DB1A7A8E13E60B437B69C05607
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

323

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Win64.PWSX-gen.24227.21513

Verdict:

Malicious activity

Analysis date:

2023-08-17 23:39:21 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/04ae1eed-4fcd-4dad-b920-9032daf927bc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/443395/

Detection(s):

SecuriteInfo.com.Win64.PWSX-gen.24227.21513.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Creating a file

Forced shutdown of a system process

Unauthorized injection to a system process

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/93cdf41efa17cd5adac34ef959cadbd1edf13275fad4804303a0ee67959fc8ca

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/15e86f7d-c3cd-443c-bae8-5976e21f660c

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1293196

Signature

.NET source code contains potential unpacker

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/93cdf41efa17cd5adac34ef959cadbd1edf13275fad4804303a0ee67959fc8ca/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2023-08-17 21:58:23 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

7 of 38 (18.42%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=spg7ihx2c7gvvwwdj34vtsw32hw7cmtv7lkiaqydudxgpfm7zdfa._file

Verdict:

malicious

211809c137b352584707b7d3b254df7e9b80302615f758ff8060b535d8804945

29f5a8629986da0b4a353e5423fb39c505cba7c06e7aa4b5a4029c5a1669ae95

30175a4cdae27076cabcb5eb7106779cadc47113ef17a7b67d0e02aa840072e0

39effc8ad793805f7a5558b804d72b01de87db3a89657c91d5508612c15d3761

495af6172a43747c7b0c987be287b1ff17e16b8e0aa247d123621568bf8fa3c6

cacc7162b9c5dacdd807215b37e7a0325c8d98de656b5845dc69d4cc467b0ab7

cffee94b2fed3ea5bf85eb7bab308ac9488d1ed882c02787ee318760b1a90350

d658e8fb0b5f39bb035ce027c28331853331bf176ba5eb394d93b639233c6660

e35c87c08c28d8e1796b43484b54dfa8f13adb80f1e1e4161d306ebd762f631e

+ 781 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/230817-3m96naff6t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

93cdf41efa17cd5adac34ef959cadbd1edf13275fad4804303a0ee67959fc8ca

MD5 hash:

46c20cfca7c996514a48fed3f419fb86

SHA1 hash:

f963d84bf8258d8cd9ce7e64261b43052d45389d

Link:

https://www.unpac.me/results/3ac52700-c198-4fcf-981c-6a53957eecc6/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/93cdf41efa17cd5adac34ef959cadbd1edf13275fad4804303a0ee67959fc8ca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.