🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95214d9b5c1664031bfd15faea7dff8d9eddbb4907d1b3bcfbcfd79c920e9e56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95214d9b5c1664031bfd15faea7dff8d9eddbb4907d1b3bcfbcfd79c920e9e56
SHA3-384 hash: d5598c7f84fc25b3573c8c85be9d000640186986afe53d660835c0ed3b01b0a4ff643ecd3a0a455e711a311ee6e3ef1c
SHA1 hash: 77a71acd8f071dd295044499ff103c3aaa72c8b9
MD5 hash: 55adc8926379b28e1058471995f18873
humanhash: freddie-vermont-item-comet
File name:SecuriteInfo.com.Trojan.Zpevdo.9088.24417
Download: download sample
File size:889'608 bytes
First seen:2024-02-19 16:34:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6d378b6ff06c71c5e5db2ed4c0703c08 (2 x Mirai, 1 x SimpleHelp)
ssdeep 24576:P7zwUDR7iornbBZHxiS6Ik/NfNp1LHT4t:RR7iornbXn6d1fNptz4t
TLSH T1AA15120572C2C2F2D443417215699B72DB3BB3761B18A9C3A7905F9E9D372F1A73B288
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10523/12/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 72fcb0a2a0b0f07c (9 x SimpleHelp, 4 x Mirai, 1 x CobaltStrike)
Reporter SecuriteInfoCom
Tags:exe signed

Code Signing Certificate

Organisation:SimpleHelp Ltd
Issuer:Thawte Code Signing CA - G2
Algorithm:sha1WithRSAEncryption
Valid from:2011-10-17T00:00:00Z
Valid to:2013-11-23T23:59:59Z
Serial number: 56e4a1cfd00581c38393f9608e41a813
Intelligence: 8 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: da35a0a9a2f6a1c8e085e027338cf59dce127bc23f8eeeb3d6fa49f5ab6fc261
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
299
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/476832/
Detection(s):
SecuriteInfo.com.Trojan.Zpevdo.9088.24417.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file
Creating a window
Creating a process from a recently created file
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %temp% subdirectories
Moving a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Replacing files
Searching for the window
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint lolbin overlay remote
Link:
https://www.filescan.io/uploads/65d383380ba622dfa953157b/reports/17a000a3-7b1f-457e-8e04-de427b514426/overview
Verdict:
Suspicious
Labled as:
Trojan.Zpevdo
Link:
https://www.hybrid-analysis.com/sample/95214d9b5c1664031bfd15faea7dff8d9eddbb4907d1b3bcfbcfd79c920e9e56
Malware family:
PeddleCheap
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6826bf17-6bbf-46b5-a5a3-872fd4456ef1
Result
Threat name:
n/a
Detection:
suspicious
Classification:
troj.spyw.evad
Score:
39 / 100
Link:
https://www.joesandbox.com/analysis/1394702
Signature
Contains functionality to register a low level keyboard hook
Java source code contains very large array initializations
Submitted sample is a known malware sample
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1394702 Sample: SecuriteInfo.com.Trojan.Zpe... Startdate: 19/02/2024 Architecture: WINDOWS Score: 39 50 support.commstream.net 2->50 54 Submitted sample is a known malware sample 2->54 56 Contains functionality to register a low level keyboard hook 2->56 58 Uses known network protocols on non-standard ports 2->58 60 Java source code contains very large array initializations 2->60 8 SecuriteInfo.com.Trojan.Zpevdo.9088.24417.exe 613 2->8         started        signatures3 process4 dnsIp5 52 support.commstream.net 208.72.168.12, 49709, 49710, 49711 CC-ASN1CA Canada 8->52 30 C:\ProgramData\...\Remote Access.exe, PE32 8->30 dropped 32 C:\ProgramData\...\zip.dll, PE32 8->32 dropped 34 C:\ProgramData\...\w2k_lsa_auth.dll, PE32 8->34 dropped 36 42 other files (none is malicious) 8->36 dropped 12 Remote Access.exe 132 8->12         started        15 lzma.exe 1 8->15         started        17 verpatch.exe 1 8->17         started        19 6 other processes 8->19 file6 process7 file8 38 C:\...\Remote AccessECompatibility.exe, PE32 12->38 dropped 40 C:\...\Remote AccessWinLauncher.exe, PE32 12->40 dropped 42 C:\ProgramData\...\utils_wnative64.dll, PE32+ 12->42 dropped 48 13 other files (none is malicious) 12->48 dropped 21 verpatch.exe 1 12->21         started        24 Remote Access.exe 12->24         started        26 Remote AccessECompatibility.exe 4 12->26         started        44 C:\ProgramData\...\verpatch.exe, PE32 15->44 dropped 46 C:\ProgramData\...\RCXF40C.tmp, PE32 17->46 dropped process9 file10 28 C:\ProgramData\...\RCX1187.tmp, PE32 21->28 dropped
Score:
82%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/95214d9b5c1664031bfd15faea7dff8d9eddbb4907d1b3bcfbcfd79c920e9e56
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/95214d9b5c1664031bfd15faea7dff8d9eddbb4907d1b3bcfbcfd79c920e9e56/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=suqu3g24czsagg75cx5ou7p7rwpn3o2ja7i3hph3z7lzzeqotzla._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/240219-t3m7dsgg72/
Behaviour
Suspicious use of WriteProcessMemory
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
f16b39ef342323d997b2cc9b649a94b6ebd12954671f357d1ed690bd7eb5ba7f
MD5 hash:
71dc11c495355f883498ff5e8702bb3d
SHA1 hash:
9685190619088991a89ab6b96f8595453bb7f795
Link:
https://www.unpac.me/results/97906320-cb0d-4341-801a-5bae3d023769/
SH256 hash:
95214d9b5c1664031bfd15faea7dff8d9eddbb4907d1b3bcfbcfd79c920e9e56
MD5 hash:
55adc8926379b28e1058471995f18873
SHA1 hash:
77a71acd8f071dd295044499ff103c3aaa72c8b9
Link:
https://www.unpac.me/results/97906320-cb0d-4341-801a-5bae3d023769/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/95214d9b5c1664031bfd15faea7dff8d9eddbb4907d1b3bcfbcfd79c920e9e56

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/476832/

Comments