MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a164a56178ed04e87b40798f3ac2c0695366262d15156ac9b1e475f0ac6afc6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a164a56178ed04e87b40798f3ac2c0695366262d15156ac9b1e475f0ac6afc6e
SHA3-384 hash: d7cceb24592f06c8ab114fc77dff7c13defcbc65175743022445c47b3553f3f01f05e5358aabddca8cf41896923dc73c
SHA1 hash: 3f4d31c4d587a1d0591563561a469978a18942c2
MD5 hash: e7816d5bfa97262a36c31c72ce57b8ed
humanhash: leopard-nineteen-nitrogen-mars
File name:EXTSETUP_1_6.exe
Download: download sample
File size:5'552'280 bytes
First seen:2022-06-13 16:01:26 UTC
Last seen:2022-06-13 16:49:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 15dfc095689ca2f6fcdaa352e6ced911
ssdeep 98304:krgYGQsiIqPAv0FZfZxr4M4P42fqM/5naGYvvA5NuU:kXaiIT0FZf7r4FRao5IU
TLSH T1C346235263C505EAECA33638D4869907C5B3FC2227F5C2EF87416B5E5A23AD01B7A707
TrID 43.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
27.6% (.EXE) Win64 Executable (generic) (10523/12/4)
13.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) OS/2 Executable (generic) (2029/13)
5.2% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter obfusor
Tags:exe signed

Code Signing Certificate

Organisation:南阳多竹网络科技有限公司
Issuer:Sectigo Public Code Signing CA R36
Algorithm:sha384WithRSAEncryption
Valid from:2021-08-10T00:00:00Z
Valid to:2022-08-10T23:59:59Z
Serial number: 894b992184cb80eae2e7468f6d8079c1
Thumbprint Algorithm:SHA256
Thumbprint: 021da34008510e8e5988c16600d4221c53dd4e792288f39b66fe6846d6044422
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
285
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
EXTSETUP_1_6.exe
Verdict:
No threats detected
Analysis date:
2022-06-13 20:30:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/336f7a67-4460-4578-9bf8-0259bbfa1a44

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/279472/
Detection(s):
SecuriteInfo.com.Variant.Lazy.188993.10556.11109.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for the window
Launching a process
Creating a process with a hidden window
Creating a window
Searching for synchronization primitives
Creating a file in the system32 directory
Launching a service
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Sending an HTTP POST request
Creating a file
Creating a process from a recently created file
Enabling autorun for a service
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/21029/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed warp
Link:
https://www.filescan.io/uploads/62a75f8696efd87b05f65f65/reports/fd258336-b36e-4251-8bdc-839c0fc2b315/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6cfb5441-a8bd-40f0-a6c9-7f7f48760bf9
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
45 / 100
Link:
https://www.joesandbox.com/analysis/1012205
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a164a56178ed04e87b40798f3ac2c0695366262d15156ac9b1e475f0ac6afc6e/
Threat name:
Win64.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2022-06-12 06:53:35 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ufskkyly5ucoq62apghtvqwanfjwmjrncukwvsnr4r27bldk7rxa._file
Verdict:
suspicious
Gathering data
Unpacked files
SH256 hash:
a164a56178ed04e87b40798f3ac2c0695366262d15156ac9b1e475f0ac6afc6e
MD5 hash:
e7816d5bfa97262a36c31c72ce57b8ed
SHA1 hash:
3f4d31c4d587a1d0591563561a469978a18942c2
Link:
https://www.unpac.me/results/77f09fef-beb3-474a-98bf-c1331e2d5d99/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a164a56178ed/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a164a56178ed04e87b40798f3ac2c0695366262d15156ac9b1e475f0ac6afc6e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/279472/

Comments