MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9707d11827331b9babc2f2b426630d63c7960234ec3ddfc2dc19a529690d96c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9707d11827331b9babc2f2b426630d63c7960234ec3ddfc2dc19a529690d96c2
SHA3-384 hash: e023122588665b4ec50ebd547ef44fbcaa5d98ac30f26513e391996ce198dd839ee17c982ec7c922fbcb8fbb1875b8b0
SHA1 hash: d597bf14b98c31d7079368110527e229d5653323
MD5 hash: 03233712acd5f013f87b7a1d80a70a8a
humanhash: sodium-alpha-papa-lima
File name:file
Download: download sample
File size:1'468'416 bytes
First seen:2024-12-02 04:01:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 24576:1WQs5yB3S77pW2tzYk6hUzai0UROiU7g9hy3IHDAXTvSSTqZAM9xk:1WQvYySaD9iUKxH0jvSU2A
TLSH T1C4651244D3A8450DEBA52FB0A533291046F5EED47873EB4E7E98F0FC143BBE564261A2
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon d4cca89496a0ccb2 (2 x AgentTesla, 1 x Loki, 1 x ArkeiStealer)
Reporter Bitsight
Tags:exe


Avatar
Bitsight
url: http://31.41.244.11/files/6802601040/tR7DLnB.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
471
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-12-02 04:05:15 UTC
Tags:
purecrypter purelogs stealer
Link:
https://app.any.run/tasks/a200956e-ee00-486c-97c0-2ccbe383dcaa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.RATX-gen.8368.29314.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=674d324204c232bff3b5b2d2
Tags:
malware
Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/674d313ac14b5f71b2f526f3/reports/a4c548dd-b8d4-416c-ba24-81665924ec0d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/9707d11827331b9babc2f2b426630d63c7960234ec3ddfc2dc19a529690d96c2
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/59b327d4-94f2-401e-805e-9fcac5afc7ec
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1566385
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
AI detected suspicious sample
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9707d11827331b9babc2f2b426630d63c7960234ec3ddfc2dc19a529690d96c2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9707d11827331b9babc2f2b426630d63c7960234ec3ddfc2dc19a529690d96c2/
Threat name:
Win32.Trojan.Jalapeno
Create hunting rule
Status:
Malicious
First seen:
2024-12-02 04:02:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s4d5cgbhgmnzxk6c6k2cmyynmpdzmaru5q657qw4dgsss2ins3ba._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
collection discovery
Link:
https://tria.ge/reports/241202-elr2patpcm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/22e9f6f8-f63b-4a3f-b6e7-6b3a51e90228
Unpacked files
SH256 hash:
e6c106bdc97ff4bb4575500a52f2a854e5f87090ccf5d8c0782e101aa07c17aa
MD5 hash:
3b069bdcdd0e9d749ba67ec6adecebe6
SHA1 hash:
d61f055040dcbbd678be464832974e7fd8d2df1c
Link:
https://www.unpac.me/results/4d79a81b-e5d4-4c0b-8d73-4e466e4772b4/
SH256 hash:
19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372
MD5 hash:
4e29f75c0c51b9dec76955f0382d9541
SHA1 hash:
4899aa8e3f57339cbaec8faab777897a76fe1c3a
Link:
https://www.unpac.me/results/4d79a81b-e5d4-4c0b-8d73-4e466e4772b4/
SH256 hash:
cafd05407c9bf0161fe07126211596b67b1dfc14528c99413ec1d2d7140ffa3d
MD5 hash:
470b448b716ca2d7cc971538648e5ff3
SHA1 hash:
6596c3717bd9540b63b646478eee1b19d6faf874
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/4d79a81b-e5d4-4c0b-8d73-4e466e4772b4/
SH256 hash:
9707d11827331b9babc2f2b426630d63c7960234ec3ddfc2dc19a529690d96c2
MD5 hash:
03233712acd5f013f87b7a1d80a70a8a
SHA1 hash:
d597bf14b98c31d7079368110527e229d5653323
Link:
https://www.unpac.me/results/4d79a81b-e5d4-4c0b-8d73-4e466e4772b4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.95
Link:
https://yomi.yoroi.company/submissions/9707d11827331b9babc2f2b426630d63c7960234ec3ddfc2dc19a529690d96c2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RansomPyShield_Antiransomware
Create hunting rule
Author:XiAnzheng
Description:Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 9707d11827331b9babc2f2b426630d63c7960234ec3ddfc2dc19a529690d96c2

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3317341/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments