MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 969a97c90fb224b48d69d9e04593e698e301b17ff20f1f76d32bf20325ee9b52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 969a97c90fb224b48d69d9e04593e698e301b17ff20f1f76d32bf20325ee9b52
SHA3-384 hash: 3d5d88514a4b770b8486faa18aa88cafbab56ccd5430c8b87e50bddfb2740b71cf43ad4a277629ca489f07c32511eb8f
SHA1 hash: 88970b84422f209d98fa818642640e8f9c5b5b3f
MD5 hash: 007b1b04784cf05b9436e7639829cfdc
humanhash: magazine-lake-red-asparagus
File name:007b1b04784cf05b9436e7639829cfdc.exe
Download: download sample
File size:59'038 bytes
First seen:2023-04-03 12:35:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 1536:ImsAYBdTU9fEAIS2PEtuHbtJ/7dqrW5I7:3fY/TU9fE9PEtuHbrIa5I7
Threatray 3'731 similar samples on MalwareBazaar
TLSH T15E43C02437E0C0A7E8B307311E3A5A2A6FF9ED2114B4970F27505B5D7E76681EA1E363
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
188
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
007b1b04784cf05b9436e7639829cfdc.exe
Verdict:
No threats detected
Analysis date:
2023-04-03 13:15:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/967f37fa-b63f-4a78-812a-6bb2ae2e09a5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/379642/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/76298/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
86%
Tags:
comodo nemesis overlay packed remcos shell32.dll
Link:
https://www.filescan.io/uploads/642ac83c2574f671607ce2f6/reports/1df3fbae-c627-46f2-99bb-7051ea049ab4/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/969a97c90fb224b48d69d9e04593e698e301b17ff20f1f76d32bf20325ee9b52
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/429edc54-a038-4d3b-bb15-f44e466dfcb0
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1207419
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/969a97c90fb224b48d69d9e04593e698e301b17ff20f1f76d32bf20325ee9b52/
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2023-04-02 17:40:03 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s2njpsipwisljdlj3hqele7gtdrqdml76ihr65wtfpzagjpotnja._file
Verdict:
unknown
Similar samples:
0b27deefbf362687701891f8fcbacf4122ce0a6e4972bc7b68cc8f3e7034b1eb
0bd6d3905b8463f23246c3b7953239277f0ffbf0096367ca02dce1cc38cc4e27
29032ae14e315863a55a0851c3e1c9cb246beb4513a279d8b1bf7fac97be6ff7
3632e05e0742cd8f5d764ecaf243796aeb11ba5dfa858d4a2a2fae1d04734dcb
82d448cb2461440d0ab1777690a41e228118c36961d8ee506ce94a9622b8af5d
8eaffa403a0bacae0e43928c07f77ea8540b480eda49e10d4a44079b8e0236fe
9ada0ca121fe2b402b0da1728cd9f1fbb36d61a62fd40bbe8428756c329e04e8
bc49d2a85d44b57a55063bf2f784f96d127a7ec7ad0b9f385ade2cf3d713e35b
ebb0272ecef9d8bf07a71b9ead8718760d27c4fdc334fe2de7a8b93237e61044
f747c8459e01b65714e550719afb55cbe6ccb459ddadaf611b35f3454086c8ea
+ 3'721 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230403-psx7dsef75/
Behaviour
Enumerates physical storage devices
Unpacked files
SH256 hash:
969a97c90fb224b48d69d9e04593e698e301b17ff20f1f76d32bf20325ee9b52
MD5 hash:
007b1b04784cf05b9436e7639829cfdc
SHA1 hash:
88970b84422f209d98fa818642640e8f9c5b5b3f
Link:
https://www.unpac.me/results/341074e9-cb2d-497d-82d9-df31234dc87a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/969a97c90fb224b48d69d9e04593e698e301b17ff20f1f76d32bf20325ee9b52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 969a97c90fb224b48d69d9e04593e698e301b17ff20f1f76d32bf20325ee9b52

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2590352/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/379642/

Comments