MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1a664da8caa18e946e0f75b9153a6740e63f1c71d00ff6c7c43b5e8a2e50c6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1a664da8caa18e946e0f75b9153a6740e63f1c71d00ff6c7c43b5e8a2e50c6e
SHA3-384 hash: 8395c7c61105d0b45efbebf4cddfbd6769002a620909a0714515342bff8c2f23f7158bd9eb721cddbeba3aed2a950cc0
SHA1 hash: caff35c791ab0418d699b11bdcadba26d45d16d1
MD5 hash: 5cc3a1deee81b63307536149304b4d66
humanhash: jupiter-bravo-stream-five
File name:SetupFile.exe
Download: download sample
File size:5'233'664 bytes
First seen:2022-12-11 08:56:45 UTC
Last seen:2022-12-11 10:31:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 49152:T+ZJahQjXItB1qfgJCSovSwed/umA/onDLTE9diTRg7d9:WoQMtB1qjSISw6uwPAmRE
Threatray 3'507 similar samples on MalwareBazaar
TLSH T10F36C79C766072DFC957C476DAA81C68FB6074BB831F4613902706ADAE4D89BCF580F2
TrID 45.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.4% (.EXE) Win64 Executable (generic) (10523/12/4)
9.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.6% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/345154/
Detection(s):
SecuriteInfo.com.Variant.MSILHeracles.54696.16503.30981.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for the window
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
Creating a process with a hidden window
Searching for the Windows task manager window
Running batch commands
Enabling the 'hidden' option for recently created files
Creating a window
Adding an access-denied ACE
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Enabling a "Do not show hidden files" option
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63959b6055eb3470cd501bcc/reports/4afdd2e7-8fc7-47fd-8bdd-0abd69894386/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f194eb6a-277f-4054-a8f4-9c0cf76dcd64
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1132175
Signature
Allocates memory in foreign processes
Detected unpacking (changes PE section rights)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 764899 Sample: SetupFile.exe Startdate: 11/12/2022 Architecture: WINDOWS Score: 100 68 Multi AV Scanner detection for submitted file 2->68 70 Detected unpacking (changes PE section rights) 2->70 72 Machine Learning detection for sample 2->72 74 4 other signatures 2->74 8 SetupFile.exe 4 2->8         started        12 NVIDIAWebHelperService.exe 2 2->12         started        14 NVIDIAWebHelperService.exe 2 2->14         started        16 NVIDIAWebHelperService.exe 2->16         started        process3 file4 62 C:\Users\user\AppData\...\filedolfe.exe, PE32 8->62 dropped 64 C:\Users\user\AppData\...\dashboard.exe, PE32 8->64 dropped 66 C:\Users\user\AppData\...\SetupFile.exe.log, CSV 8->66 dropped 78 Detected unpacking (changes PE section rights) 8->78 80 Writes to foreign memory regions 8->80 82 Allocates memory in foreign processes 8->82 84 Injects a PE file into a foreign processes 8->84 18 dashboard.exe 1 5 8->18         started        22 filedolfe.exe 3 8->22         started        24 InstallUtil.exe 2 8->24         started        86 Multi AV Scanner detection for dropped file 12->86 88 Machine Learning detection for dropped file 12->88 signatures5 process6 file7 60 C:\Users\user\...60VIDIAWebHelperService.exe, PE32 18->60 dropped 76 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->76 26 cmd.exe 1 18->26         started        28 cmd.exe 1 18->28         started        30 schtasks.exe 1 18->30         started        32 schtasks.exe 1 18->32         started        34 cmd.exe 1 22->34         started        36 cmd.exe 1 22->36         started        38 schtasks.exe 1 22->38         started        40 conhost.exe 24->40         started        signatures8 process9 process10 42 conhost.exe 26->42         started        44 choice.exe 1 26->44         started        46 conhost.exe 28->46         started        48 conhost.exe 30->48         started        50 conhost.exe 32->50         started        52 conhost.exe 34->52         started        54 choice.exe 1 34->54         started        56 conhost.exe 36->56         started        58 conhost.exe 38->58         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1a664da8caa18e946e0f75b9153a6740e63f1c71d00ff6c7c43b5e8a2e50c6e/
Threat name:
ByteCode-MSIL.Trojan.Heracles
Create hunting rule
Status:
Malicious
First seen:
2022-12-10 00:59:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
499
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ugtgjwumvimosrxa65nzcu5goqhgh4ohduap63d4io26rixfbrxa._file
Verdict:
malicious
Similar samples:
257b99a8149825c3714e40ef1f4e0d1ccb35e0cc692deeb4e9fab1f38d9dddc9
2e1d1c1629abb3aa966337d50dce159721048417ee11b47127302dae0eb3f09c
8d40ac7ff823a82053b413326beba33bf94380a79c49165545fed3e92089b6eb
a1a3d07b7d2a764011affbede324e5f01590697e110a1c934d21c3627d3d1484
cc0bd45536a6c15f8b76fe06fd637857e6fbb483dc620793aa3aa27e1ab75a62
ded71c5ce8ef725195aa7278bf566f708a07e76f8cd99ec1f8f40710749ed1d7
e0efcfb64134200889c4a098fcd2d0d0031bf6b5b5e0c718059b39bdf63aad91
+ 3'497 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/221211-kwk9sabd6z/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b7fd2fe8-bd5f-47e0-9b71-b555658e7e9e
Unpacked files
SH256 hash:
4e46991f864be3261a0725ab64b98b9735954bf178c53747c49b369eb96b8e29
MD5 hash:
040c7c5875f3e569a716172d4f6f8f52
SHA1 hash:
e9c58aa770452c465f1d6ebb315188a1c35571f3
Link:
https://www.unpac.me/results/fad714d7-51d3-493b-bdaa-f0e7680d661e/
SH256 hash:
592984ba4c807760c5a5c4c3a1c32602b79c17595543acbadb4760de35e29e86
MD5 hash:
e279f5a291b8f98745da63340d7fff98
SHA1 hash:
87feb59edc2ea93895062f3bf5186cdde4984b37
Link:
https://www.unpac.me/results/fad714d7-51d3-493b-bdaa-f0e7680d661e/
SH256 hash:
7a1b7f211076779a48b29a9697eabb1ca90588ff9b963bc7e792e2bc1a1a0e37
MD5 hash:
2f40c156ffab4db7521b11a37014e998
SHA1 hash:
862dd219782fb35e72bec361514e9ad3df9d03ac
Link:
https://www.unpac.me/results/fad714d7-51d3-493b-bdaa-f0e7680d661e/
SH256 hash:
a1a664da8caa18e946e0f75b9153a6740e63f1c71d00ff6c7c43b5e8a2e50c6e
MD5 hash:
5cc3a1deee81b63307536149304b4d66
SHA1 hash:
caff35c791ab0418d699b11bdcadba26d45d16d1
Link:
https://www.unpac.me/results/fad714d7-51d3-493b-bdaa-f0e7680d661e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a1a664da8caa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a1a664da8caa18e946e0f75b9153a6740e63f1c71d00ff6c7c43b5e8a2e50c6e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/345154/

Comments