MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1a0ca95d42cb766533d9c4a8260cdcea4abab6d17214b711b7f366fbafe2413. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1a0ca95d42cb766533d9c4a8260cdcea4abab6d17214b711b7f366fbafe2413
SHA3-384 hash: 61821ba4175913ef2370797778be5accf33522e52985d14380225e277a7f76642ad1ae45af96c2cd4bec7b672f5caf21
SHA1 hash: c0112f00545a22b383e521f75c8090871faf58cc
MD5 hash: 08d2ae8c175f0185463315c7f6c68db1
humanhash: lemon-happy-sierra-foxtrot
File name:hm.exe
Download: download sample
File size:2'097'152 bytes
First seen:2021-06-11 15:36:30 UTC
Last seen:2021-06-11 16:50:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:oWTIMep2y6aX1TDX6/IL62VhaSVnX6lem:oWcMyDKA3hNX6lem
Threatray 12 similar samples on MalwareBazaar
TLSH 53A5338C6D66C426C58239FE0A364B87D7F4FD632A8B7D3679F246AC321113A367641C
Reporter r3dbU7z
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
hm.exe
Verdict:
No threats detected
Analysis date:
2021-06-11 15:40:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d2030de9-f323-4d0f-bc79-cdaa12b2ff34

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/166159/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.721.10406.25440.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Creating a process with a hidden window
Launching a process
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Creating a file
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8fc1f63d-cf64-4b09-8359-1c71e71b1bd3
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/800971
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Found strings related to Crypto-Mining
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 433367 Sample: hm.exe Startdate: 11/06/2021 Architecture: WINDOWS Score: 100 116 Multi AV Scanner detection for submitted file 2->116 118 Yara detected Xmrig cryptocurrency miner 2->118 120 .NET source code contains potential unpacker 2->120 122 2 other signatures 2->122 11 hm.exe 8 2->11         started        process3 dnsIp4 114 192.168.2.1 unknown unknown 11->114 108 C:\Users\user\AppData\...\ChromeUpdater.exe, PE32+ 11->108 dropped 110 C:\...\ChromeUpdater.exe:Zone.Identifier, ASCII 11->110 dropped 112 C:\Users\user\AppData\Local\...\hm.exe.log, ASCII 11->112 dropped 15 sihost32.exe 3 11->15         started        18 ChromeUpdater.exe 4 11->18         started        20 cmd.exe 1 11->20         started        file5 process6 signatures7 136 Multi AV Scanner detection for dropped file 15->136 138 Machine Learning detection for dropped file 15->138 22 ChromeUpdater.exe 3 15->22         started        24 ChromeUpdater.exe 3 15->24         started        26 ChromeUpdater.exe 15->26         started        28 ChromeUpdater.exe 15->28         started        140 Hijacks the control flow in another process 18->140 142 Injects code into the Windows Explorer (explorer.exe) 18->142 144 Writes to foreign memory regions 18->144 148 3 other signatures 18->148 30 cmd.exe 18->30         started        32 explorer.exe 18->32         started        146 Uses schtasks.exe or at.exe to add and modify task schedules 20->146 34 conhost.exe 20->34         started        36 schtasks.exe 1 20->36         started        process8 process9 38 sihost32.exe 22->38         started        40 cmd.exe 22->40         started        42 cmd.exe 24->42         started        44 cmd.exe 26->44         started        46 conhost.exe 30->46         started        48 schtasks.exe 30->48         started        process10 50 ChromeUpdater.exe 38->50         started        53 ChromeUpdater.exe 38->53         started        55 ChromeUpdater.exe 38->55         started        65 4 other processes 38->65 57 conhost.exe 40->57         started        59 schtasks.exe 40->59         started        61 conhost.exe 42->61         started        63 schtasks.exe 42->63         started        68 2 other processes 44->68 file11 124 Hijacks the control flow in another process 50->124 126 Injects code into the Windows Explorer (explorer.exe) 50->126 128 Writes to foreign memory regions 50->128 70 cmd.exe 50->70         started        72 explorer.exe 50->72         started        130 Allocates memory in foreign processes 53->130 132 Modifies the context of a thread in another process (thread injection) 53->132 134 Injects a PE file into a foreign processes 53->134 74 cmd.exe 53->74         started        76 explorer.exe 53->76         started        78 cmd.exe 55->78         started        106 C:\Users\user\AppData\...\sihost32.exe, PE32+ 65->106 dropped 80 cmd.exe 65->80         started        82 cmd.exe 65->82         started        84 cmd.exe 65->84         started        86 cmd.exe 65->86         started        signatures12 process13 process14 88 conhost.exe 70->88         started        90 schtasks.exe 70->90         started        92 conhost.exe 74->92         started        94 schtasks.exe 74->94         started        96 2 other processes 78->96 98 2 other processes 80->98 100 2 other processes 82->100 102 2 other processes 84->102 104 2 other processes 86->104
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1a0ca95d42cb766533d9c4a8260cdcea4abab6d17214b711b7f366fbafe2413/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-11 15:37:10 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
1ed5337566938228ee9afcad29b1f722d55f4f8172a3157af4d4ad913541b2ea
3b019e395d076e03b3b4a2d9468d3acb36df69115e059119194fbd8dd6d1dd6b
568a4dae9810114a99e28f70c4b3daa29ecdfa9757675f61b2947f578c5f2c05
770b35e82759eb0107679b50d38f5e40175901c548a5fd8282e116e8d455c418
8409519ab2c6e5ca0e85e40216c98444ac257a491fa8849ce4b3b320df0a0566
a5e6caf0fc19953ef3c7ec323b851f1b14bde593f75d0113e0cada70880912df
b50cfd0edcdb6b99115f83ae101003203d113e40e7cf1fa9c796886115f8c994
c9181af10ea92bd10670128f29becf59ace555e7c3b2f249a0a0ee7930ac64cc
e31da697e1f30aca20cb88b09a69ed60bdbba9b3c4da0e67e2654ecb541964f2
e7d6efa5783c7c9a417518ee96f0ddbb919ab711669cbf68ef6caa27dac966d5
+ 2 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210611-wnwjb5778s/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
a1a0ca95d42cb766533d9c4a8260cdcea4abab6d17214b711b7f366fbafe2413
MD5 hash:
08d2ae8c175f0185463315c7f6c68db1
SHA1 hash:
c0112f00545a22b383e521f75c8090871faf58cc
Link:
https://www.unpac.me/results/7e23fbfc-4d3e-41da-a43b-2a9f50ef72d8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a1a0ca95d42cb766533d9c4a8260cdcea4abab6d17214b711b7f366fbafe2413

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/166159/

Comments