MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9457d4e34b42f16a6c5188ef0b999cff68b75ec998bc252c75914850625c09b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9457d4e34b42f16a6c5188ef0b999cff68b75ec998bc252c75914850625c09b4
SHA3-384 hash: db2b44362573b593539ab10e7ea0d56d59f9cd3cf6c4a8195eb6bedf0f454ec44e958ffb2c857b0ff5acc8330f26a45b
SHA1 hash: 423a3a78d35a89336009b57129f8e65e8b17137c
MD5 hash: 86e48eb78ecead97e18f8bc5b95f213d
humanhash: iowa-papa-ink-magazine
File name:86e48eb78ecead97e18f8bc5b95f213d.exe
Download: download sample
File size:5'699'968 bytes
First seen:2021-08-29 15:11:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b462095fea3219e285e54ac0547eead6 (5 x AgentTesla, 4 x QuasarRAT, 1 x YoungLotus)
ssdeep 98304:5ewfPe82WLFj+exezhn6QKKUcdng0806ZjTuCJBz9+H67R25J9:5/Pekiee9Yrw6Zrga7I9
Threatray 5'445 similar samples on MalwareBazaar
TLSH T127463315BAC88677C4223EFCCCEA82A4423DEB616E389C597FD88C1C4F236525D95397
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
86e48eb78ecead97e18f8bc5b95f213d.exe
Verdict:
Malicious activity
Analysis date:
2021-08-29 15:13:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/dc386504-76b8-453b-ac6c-65c49e228391

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/183271/
Detection(s):
PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Sending an HTTP GET request to an infection source
Creating a process from a recently created file
DNS request
Connection attempt
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Deleting a recently created file
Connection attempt to an infection source
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b5fd4d1d-c1bf-4d11-9765-bcd47c4e5aff
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/841077
Signature
Antivirus detection for URL or domain
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9457d4e34b42f16a6c5188ef0b999cff68b75ec998bc252c75914850625c09b4/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-08-29 15:12:06 UTC
AV detection:
13 of 43 (30.23%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0924992f8005f8f64b0bbfc1fd8a7946f4afb994a631de073c6acb65ea5fb42b
13713a7b6d609042754fb59c1c9f3049c27c5ac8b052fd2e71f4025b8bc8e8ad
25620797ecd86aeef9aa61eb003cac2a45944a3abf23e155e4827c7cad4b7154
6208bcf39112f17ddce04ccc8eafa989009cf857f9adac40345dadd8863a0850
635eb39e1cfce400a91e879a4278b2c1bba9d2f5e49ac18f44f077dad7abd8d1
ad8e4031c8f2c544a2ca6bb64ebc98f82acacde9cc819f1c36b11a4311a30195
c599fe2a2f6b6e01b34b75188fdab23735abe17bb71965b92275834ba96f060a
c5c30168b19d36451d4c5ffd3d653dbda65326be0bdb5b5c7f5f5e977c0b1326
ca30d2ff4ed55eddc312e5ce11b1b92ea932d5994a3e6a0d8cf7e0bf952e0547
d5f329e696bff2eeb46fc94907f1a4ee9694dee87e036ef1f1d20deece4d3974
+ 5'435 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210829-yz6xmkbshn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Looks up external IP address via web service
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Unpacked files
SH256 hash:
d838c40848daf87743e96d42f8db18bb66a0b27cff5a48926a85a61c2d3e05b9
MD5 hash:
0bfef61b203054f6fbf08419ffe3f018
SHA1 hash:
ed9d0418507630996eb2c473ec5daf11d185c2c6
Link:
https://www.unpac.me/results/eacbd384-8b62-42d3-816c-15ebabb533ff/
SH256 hash:
402f2982ce7a1bffa38eff76338c5cfe04aeaf278b20d55d5b270390e658bc34
MD5 hash:
dfdaf21a1724707181e5d61b7241ed33
SHA1 hash:
e6693e7b1558f31ae09cf28663e880e636006e72
Link:
https://www.unpac.me/results/eacbd384-8b62-42d3-816c-15ebabb533ff/
SH256 hash:
0b120ee62f9ae12acd9c9994d43579141c5e4ae8ec84acbf227dd57afacc42e4
MD5 hash:
6d94f52bd532c57995a6b011f8b14f50
SHA1 hash:
e0047e9a014405b63aaa05336ec3b9bd173d60e6
Link:
https://www.unpac.me/results/eacbd384-8b62-42d3-816c-15ebabb533ff/
SH256 hash:
56b7d4ae39749f000e75b4b6c11d6617715b8463ba7305623b1810c428efed20
MD5 hash:
7e04d20f79cb5882698cddc408666bf3
SHA1 hash:
ac0643668506f2ee25a0bf487bd37c6323b7d8dd
Link:
https://www.unpac.me/results/eacbd384-8b62-42d3-816c-15ebabb533ff/
SH256 hash:
dadca335ab25517609326de40001ea5aaeb0bfa1139f3458df26b07209dc121b
MD5 hash:
5f2a0d681844db68511822247258b551
SHA1 hash:
8fc493af235064349122c82d6bdfb010762734c3
Link:
https://www.unpac.me/results/eacbd384-8b62-42d3-816c-15ebabb533ff/
SH256 hash:
4870018813eff9a5b050044c5eb639bb3e536ec1cd3ad03da389b83216c0f4d5
MD5 hash:
1d5041dc5a86b787d9701b78a9e0b121
SHA1 hash:
88873d0af22c924869f8c10c46e9b8f765d9b998
Link:
https://www.unpac.me/results/eacbd384-8b62-42d3-816c-15ebabb533ff/
SH256 hash:
cabf9e38d01ba8cb3aab7dfe5e552ca3d8cc143b781f4fc9aa0def2f51dddea1
MD5 hash:
f3a600b88b5aabb55aa0df501e84a302
SHA1 hash:
58ae68f846c6b356cb3fcb53ac0d770140a25703
Link:
https://www.unpac.me/results/eacbd384-8b62-42d3-816c-15ebabb533ff/
SH256 hash:
7a4dde948b573b5a92cb1f63a2201006e61ea24107d9668a36efa378e8d48f08
MD5 hash:
83dfd2fe35efb2154bcdd3b475f378f2
SHA1 hash:
43eaf586250bf5c8b32eb832cf3479a8dbf7cca2
Link:
https://www.unpac.me/results/eacbd384-8b62-42d3-816c-15ebabb533ff/
SH256 hash:
1e02248fc226f1813f9a473aaf8dc9bd264101a6e371ddb73e145c0949834d47
MD5 hash:
4b874a3043d5e3c133f4c35863159638
SHA1 hash:
3a7d21700497d81c41193544b7ea913032d0aa82
Link:
https://www.unpac.me/results/eacbd384-8b62-42d3-816c-15ebabb533ff/
SH256 hash:
8ebc19481aeef34c37a19c84a1664064120bbec8e5fe376a2ea184705638329b
MD5 hash:
130fad0f1f3e97a740b7c7fd84e053a5
SHA1 hash:
327de7805ba6388c015dc20d782c094f8f799cc1
Link:
https://www.unpac.me/results/eacbd384-8b62-42d3-816c-15ebabb533ff/
SH256 hash:
1f92155fe20af79395e444d96023f62ac67cf9ae4a5d23a684266cb18f273290
MD5 hash:
12beef8596fb6e47ccfdb584f4d0cd19
SHA1 hash:
309eda554d7c5be513a676b431c639d287b1a454
Link:
https://www.unpac.me/results/eacbd384-8b62-42d3-816c-15ebabb533ff/
SH256 hash:
9457d4e34b42f16a6c5188ef0b999cff68b75ec998bc252c75914850625c09b4
MD5 hash:
86e48eb78ecead97e18f8bc5b95f213d
SHA1 hash:
423a3a78d35a89336009b57129f8e65e8b17137c
Link:
https://www.unpac.me/results/eacbd384-8b62-42d3-816c-15ebabb533ff/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9457d4e34b42f16a6c5188ef0b999cff68b75ec998bc252c75914850625c09b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Enigma
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Enigma
Rule name:INDICATOR_EXE_Packed_Loader
Create hunting rule
Author:ditekSHen
Description:Detects packed executables observed in Molerats
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MAL_Unknown_PWDumper_Apr18_3
Create hunting rule
Author:Florian Roth
Description:Detects sample from unknown sample set - IL origin
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 9457d4e34b42f16a6c5188ef0b999cff68b75ec998bc252c75914850625c09b4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1419298/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/183271/

Comments