MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a07afb3f48c05bc311adc6a9473310e6b35e14f14920e543ee8ca032a0af637f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a07afb3f48c05bc311adc6a9473310e6b35e14f14920e543ee8ca032a0af637f
SHA3-384 hash: 72776ae9450b8e65352f448cb1c604dabeeeb756d6b78da39a153ccefbdebd34b536061c53e6e109baf00ce60843ca31
SHA1 hash: a42f25b24cc6770c8154e7824c8bf560fbf90418
MD5 hash: e038c44ed28e724e4ff1e248e5e8005b
humanhash: autumn-fruit-sink-twenty
File name:Xsploit.exe
Download: download sample
File size:11'919'432 bytes
First seen:2022-05-08 16:44:24 UTC
Last seen:2022-05-08 17:37:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1e92fd54d65284238a0e3b74b2715062 (21 x Empyrean, 4 x Gh0stRAT, 4 x Telemiris)
ssdeep 196608:YqLl4XkYU1gqkpqiqpBAoeL2Vmd6+D5nNgwQ+dtL9Ug4L9V7kngWytT9Jk3QZsD9:X0XUifW4L2Vmd6mFNj5Uv9V73NTXkgZu
Threatray 17 similar samples on MalwareBazaar
TLSH T19EC63352736018E9E5A69C3D888AD524CE26753E2751D8CF4B50D3942F27BF0ADFEB80
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter tech_skeech
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
269
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Xsploit.exe
Verdict:
No threats detected
Analysis date:
2022-05-08 16:46:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/efbaf9fc-b676-4f59-873e-a287a1f38007

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Tedy.105918.20547.12745.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file
Running batch commands
Launching a process
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
expand.exe greyware overlay packed
Link:
https://www.filescan.io/uploads/6277f370a40dfc4df20f3d05/reports/26653966-4fdd-468e-b443-0fa172aff4a3/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/48da68e3-a8dd-4749-ba56-fbfa62a68c82
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/989784
Signature
Antivirus / Scanner detection for submitted sample
DLL side loading technique detected
Drops PE files to the startup folder
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Uses cmd line tools excessively to alter registry or file data
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 622280 Sample: Xsploit.exe Startdate: 08/05/2022 Architecture: WINDOWS Score: 76 75 ipinfo.io 2->75 81 Antivirus / Scanner detection for submitted sample 2->81 83 Multi AV Scanner detection for submitted file 2->83 85 May check the online IP address of the machine 2->85 9 Xsploit.exe 81 2->9         started        13 Xsploit.exe 81 2->13         started        signatures3 process4 file5 59 C:\Users\user\AppData\...\VCRUNTIME140.dll, PE32+ 9->59 dropped 61 C:\Users\user\AppData\...\win32crypt.pyd, PE32+ 9->61 dropped 63 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 9->63 dropped 71 65 other files (none is malicious) 9->71 dropped 93 May check the online IP address of the machine 9->93 95 Drops PE files to the startup folder 9->95 15 Xsploit.exe 8 9->15         started        65 C:\Users\user\AppData\...\VCRUNTIME140.dll, PE32+ 13->65 dropped 67 C:\Users\user\AppData\...\win32crypt.pyd, PE32+ 13->67 dropped 69 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 13->69 dropped 73 65 other files (none is malicious) 13->73 dropped 19 Xsploit.exe 13->19         started        signatures6 process7 dnsIp8 77 ipinfo.io 34.117.59.81, 443, 49796, 49818 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 15->77 79 127.0.0.1 unknown unknown 15->79 57 C:\Users\user\AppData\Roaming\...\Xsploit.exe, PE32+ 15->57 dropped 22 WMIC.exe 1 15->22         started        25 cmd.exe 1 15->25         started        27 cmd.exe 1 15->27         started        35 4 other processes 15->35 87 Tries to harvest and steal browser information (history, passwords, etc) 19->87 29 cmd.exe 19->29         started        31 cmd.exe 19->31         started        33 WMIC.exe 19->33         started        37 3 other processes 19->37 file9 signatures10 process11 signatures12 89 DLL side loading technique detected 22->89 45 2 other processes 22->45 91 Uses cmd line tools excessively to alter registry or file data 25->91 39 conhost.exe 25->39         started        41 reg.exe 1 25->41         started        47 2 other processes 27->47 49 2 other processes 29->49 51 2 other processes 31->51 43 conhost.exe 33->43         started        53 3 other processes 35->53 55 3 other processes 37->55 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a07afb3f48c05bc311adc6a9473310e6b35e14f14920e543ee8ca032a0af637f/
Threat name:
Win64.Trojan.Tedy
Create hunting rule
Status:
Malicious
First seen:
2022-05-08 16:45:46 UTC
File Type:
PE+ (Exe)
Extracted files:
1032
AV detection:
8 of 40 (20.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
04a31ae8a31bb4144d7392040442f4a38e8301cc550124cc47d012a0eba71bdd
310fae0d844061aeea3d540052c5daadd3ea406b6fcc529b44c7997ac6a09cbb
414d8e74cdb96fe1e8742018494be41cdebd5c11804a30a7876a5bcd7bf01764
476a05d5c8ef4444f96cbd02c3a315c56227b7510f75e82249a449bb79e977fc
4b56d8713523dea09695ec6beef98608c234e5f8a9be77be931a687c080fb0f1
5c718efeb3b955290112362f4d95e2e5f9c32080d14de40106cae9f42a796d52
6e86ad43d7677a7d9a81ac9dd17df97703dfb49ee4456601b4fa2edd518ce0e5
c3cad582268b165711e2f2b1834891c7bcb5e57a7efb1e709e3df19d011ad656
f63f90decc7d763f3c5202c7a4c643aeb99fd1d85ca97d64bf77fc1cc733f9f9
+ 7 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/220508-t9darscef8/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Maps connected drives based on registry
Loads dropped DLL
Unpacked files
SH256 hash:
a07afb3f48c05bc311adc6a9473310e6b35e14f14920e543ee8ca032a0af637f
MD5 hash:
e038c44ed28e724e4ff1e248e5e8005b
SHA1 hash:
a42f25b24cc6770c8154e7824c8bf560fbf90418
Link:
https://www.unpac.me/results/cca752ad-fe86-4586-b13a-32ffdabbb6d9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a07afb3f48c05bc311adc6a9473310e6b35e14f14920e543ee8ca032a0af637f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe a07afb3f48c05bc311adc6a9473310e6b35e14f14920e543ee8ca032a0af637f

(this sample)

  
Delivery method
Distributed via web download

Comments