MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9eb235579cedafa21ced3c3fd2c1f2e43adac5e85b6a5553499742b23af32656. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.Generic


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9eb235579cedafa21ced3c3fd2c1f2e43adac5e85b6a5553499742b23af32656
SHA3-384 hash: f6bbfece09734986520cc10e0c56c13d1112bc132e0fb4428a45516c4e3011823a06ed744083baa20606e0b1286f9c40
SHA1 hash: e70848f6a8504ec8c0897e21af8aef8bf4711aa1
MD5 hash: 3a0e4811785be20abfd2d27f4a31ca8d
humanhash: delta-winter-wyoming-nebraska
File name:vape_all_versions.zip.exe
Download: download sample
Signature Adware.Generic
Create hunting rule
File size:3'176'424 bytes
First seen:2021-06-22 09:43:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e00de6e48b9b06aceb12a81e7bf494c9 (20 x Adware.Generic, 1 x CoinMiner)
ssdeep 98304:TG5QgxEwE6X/foVF2OjVvgxyJWiD+aS2OSrTo:TG5pjq2c8yYiD++fg
Threatray 11 similar samples on MalwareBazaar
TLSH 24E533123CF54177FAC14872A8646ED4E0F8E6280FB14DE7375E8A2D7F3924192287E9
Reporter Anonymous
Tags:Adware.Generic exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
vape_all_versions.zip.exe
Verdict:
No threats detected
Analysis date:
2021-06-22 09:46:32 UTC
Tags:
installer
Link:
https://app.any.run/tasks/57bf65e5-bc01-4cc7-8276-a80b2b7f23ca

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/167526/
Detection(s):
SecuriteInfo.com.Trojan.Vittalia.18899.7239.14908.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.16315.17849.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.23765.15295.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.15897.124.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.5845.5582.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.9725.1671.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.11186.29307.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.432.23540.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.30820.8518.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.11984.4138.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.4290.27069.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.8813.22807.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.942.18291.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.9011.5167.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.4256.12487.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Vittalia.18899.6079.12975.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f25caaba-2458-43ea-881c-092a06c24763
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/805880
Signature
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses an obfuscated file name to hide its real file extension (double extension)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9eb235579cedafa21ced3c3fd2c1f2e43adac5e85b6a5553499742b23af32656/
Threat name:
Win32.PUA.Presenoker
Create hunting rule
Status:
Malicious
First seen:
2021-06-22 09:44:13 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t2zdkv445wx2ehhnhq75fqps4q5nvrpilnvfku2js5bleoxtezla._file
Verdict:
suspicious
Similar samples:
0f9e47562665ef5a863f2b412455f66244c6614dff49a96006473e3604b0c6f8
Adware.Generic
45ccf8e379c900f0c7496e4debe1ad4550256f6162383baba5f1344e5d9ca250
Adware.Generic
5199bcc83cf3eb34e56478868237b872fe3795b3ee5b04395ac805a98425801d
Adware.Generic
7ff82a6621e0dd7c29c2e6bcd63920f9b58bc254df9479618b912a1e788ff18b
Adware.Generic
96d1a194f5dc6fbecb472b5b39c1c5fddcbe7b8d6f5a879d106f8a5c28aa1334
Adware.Generic
a751b1f39e0eb2ab9a6246ad1597c6df78ccacde11c723c710498f01146739d1
Adware.Generic
ce7fab69a6c10146ac89e121fbe204ca424cd886c4763674eb2e9260b2f6b722
Adware.Generic
d27db19db72691d403d38243719346bca79efb3f81b6c44d9fd3cd9dfff83b9d
Adware.Generic
dc4e1c802da2d466553edf5214995a10c49306b9dd9d87a90385c7f20f29adca
Adware.Generic
fdc92c2f55c2d75500a2fd3c428f8ffc0b3f060240a70e51c31ed33f5912e611
Adware.Generic
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery
Link:
https://tria.ge/reports/210622-xmz1vk43dx/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks for any installed AV software in registry
Checks installed software on the system
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
82fec7aed6040d6d74c666e720bdee7eabd90e665e4fdc60025c191cec09e254
MD5 hash:
c21e7f55073112f7c19a7a351f128d14
SHA1 hash:
f9b80013409033089eca366cb2a02ab70d9bd5d7
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
SH256 hash:
ce735cfac1095f959224b676727c0a0481979e371015b241471a47ed975dfb02
MD5 hash:
6d31668ba88d03253b38a85bed3c9dee
SHA1 hash:
7b62340c57aa81948fa62d217c4abd23bc62fd97
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
SH256 hash:
c5f7946752a5eb082c712bc96bc975460c83aa07d9362440acee47c247f509e1
MD5 hash:
080c9fa736f1843439518abd9f9cd96a
SHA1 hash:
60b2aed31677ea5d804daa9964e015938be86499
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
SH256 hash:
64e126f64155607414dc01d0c1342e333e618cb464a4094eec499c60e0f2be1e
MD5 hash:
2d12188361ce829647b085aaff7ffa24
SHA1 hash:
30da1e4a6203b5160db0d422f91066a777783e81
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
SH256 hash:
e544ba45004d688628f70436ff69cfd7540679346b62133dde2c4c9a5e0e66fb
MD5 hash:
7cd0653a0cbe058b8335c520a35c8ca6
SHA1 hash:
2f0bfad530dc671d4fc3ad1910a3bcd06f41df33
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
SH256 hash:
042fb25cf5b11d72bc73b3930e39988f720658073ab112b93bcac998c3e58f34
MD5 hash:
f2d7c2af33cc59053218f784ce28a1f8
SHA1 hash:
0e1bc9cf0e3628b84473a49ee598eba9521074e9
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
SH256 hash:
186540a55383c43f2c2bf248e917de72a785c6a4df2ad08637b3abc5ba8e2525
MD5 hash:
d27a568738668ccd506a7c2d6cc53006
SHA1 hash:
0b207f04acd7a9d8098645f6e8d622e5fc20b267
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
SH256 hash:
03080498d08c219afcee9c05652e10a94c28541e954fe192d460ea57407b59ea
MD5 hash:
8666996ba399eefa9987b593d16da7dc
SHA1 hash:
f8444b7f495892fd902f7714df809e9cc723fe3a
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
SH256 hash:
24397bef8b9909e444d176d6b0d3e583054c6b3e357f9d192b586755ae498eac
MD5 hash:
e9780ca7a8debb4a0a9dd5dce1ff169b
SHA1 hash:
f6d77bf57f07c821835c0c7c71257749f8753e92
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
SH256 hash:
5c5a0300a6ed8ea76b92f86f2aa51bff0501d5184e9d570603476b6eef1a7399
MD5 hash:
09f55e1bb3fa6b8452b717c454aa219d
SHA1 hash:
d1922fa719f2e43ef5e861e80bb19bc3ac53c095
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
SH256 hash:
54cece311f140a4804c276e81e2b4ea184670748b08b14e690f6c385051bbdf2
MD5 hash:
24aa32bbaa182195715a2fc565531cf4
SHA1 hash:
a32b373da158922b767f4c899ef942996bec49ad
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
SH256 hash:
864e7b321fa66ad14de3334687c23e07b06d76165620da83ffcf563c072bd12f
MD5 hash:
58476d7521e18ba02a082484a2e7a327
SHA1 hash:
a1010ad05b74b551f34b9814534bf1c82a4f953f
Detections:
win_karkoff_auto
Create hunting rule
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
Parent samples :
7ff82a6621e0dd7c29c2e6bcd63920f9b58bc254df9479618b912a1e788ff18b
96d1a194f5dc6fbecb472b5b39c1c5fddcbe7b8d6f5a879d106f8a5c28aa1334
fdc92c2f55c2d75500a2fd3c428f8ffc0b3f060240a70e51c31ed33f5912e611
9eb235579cedafa21ced3c3fd2c1f2e43adac5e85b6a5553499742b23af32656
63e7fff26714fad07cb3f12293684a40e25c7b2bf2be5f5e5a94c9935a8fc5cd
d648e8e94c0674e6b1bd537936a33a39c33d3429d34fb70b97ff7f60904c9c84
SH256 hash:
31cfefe9e5c7e7188e86a926a4b45a97be998fed46b5dd67cdf4c294d9d74db8
MD5 hash:
ad0cccb87e9e9530a1c5246181d5a11b
SHA1 hash:
8e1e2a8e3e46520a04e55e48595f28232fa93616
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
SH256 hash:
98fd1035d48f3ad340d670bf515edf5ae32f96d540de1b413c5e8aef244c6fd2
MD5 hash:
824f19c315d9970e55d0a50933ad3cb0
SHA1 hash:
cc901efd09dbc03a9f7baa4bf6a3982998e9ccd6
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
SH256 hash:
9eb235579cedafa21ced3c3fd2c1f2e43adac5e85b6a5553499742b23af32656
MD5 hash:
3a0e4811785be20abfd2d27f4a31ca8d
SHA1 hash:
e70848f6a8504ec8c0897e21af8aef8bf4711aa1
Link:
https://www.unpac.me/results/b418c7ba-b83e-43d0-91f7-b7c719ed7884/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9eb235579cedafa21ced3c3fd2c1f2e43adac5e85b6a5553499742b23af32656

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/167526/

Comments