MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1e12d4289ff4d97268d309c68d94e9791c38e3963741391246fd4f351670feb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mekotio


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1e12d4289ff4d97268d309c68d94e9791c38e3963741391246fd4f351670feb
SHA3-384 hash: 7a1c2ae308cdbbee181cbefb82e88aaeb416965579f059a7bcec7a8b88b443871f539dff578556494c14c8b314183152
SHA1 hash: 29e303488f4cdc91b206f76eb10b7d5132465ce5
MD5 hash: 1bf065a892c59d7b07e74062e11a3f44
humanhash: march-kansas-kentucky-sad
File name:ID-FACT.1681805368.zip
Download: download sample
Signature Mekotio
Create hunting rule
File size:5'283'824 bytes
First seen:2023-04-18 08:10:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:V7baL0PvhyWbCVL+EW4UuIxnmbILkpphdcMdSSupZyDwpR2zI68ImH:xb3vhC1+kDIUbHJNdfPM6JmH
TLSH T14F3633BDE938D4CE46AE1730E4A4955F0BA74F3E960774AA04A54C56D703B8E2ECB1CC
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter JAMESWT_WT
Tags:ITA Mekotio spy zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
638
Origin country :
IT IT
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:FACT643e5.msi
File size:5'868'544 bytes
SHA256 hash: ae38f93b3c9b574d7ce6920906581a1ffe18782f58e751f8c1794592c264926d
MD5 hash: cf77449c2b248411f4516014b991b134
MIME type:application/x-msi
Signature Mekotio
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs3283.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.W32.Trojan.VYZK-4288.30727.UNOFFICIAL
Create hunting rule

Result
Verdict:
Unknown
File Type:
ZIP File
Link:
https://app.docguard.net/a1e12d4289ff4d97268d309c68d94e9791c38e3963741391246fd4f351670feb/results/dashboard
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
shell32.dll
Link:
https://www.filescan.io/uploads/643e509746e0911fda9ebebf/reports/7b819cba-b7b5-4b03-b410-b7a136c60976/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/a1e12d4289ff4d97268d309c68d94e9791c38e3963741391246fd4f351670feb
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/a1e12d4289ff4d97268d309c68d94e9791c38e3963741391246fd4f351670feb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1e12d4289ff4d97268d309c68d94e9791c38e3963741391246fd4f351670feb/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uhqs2quj75gzojungcogrwkos6i4hdrzmn2bhejen7kpgulhb7vq._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion persistence themida trojan
Link:
https://tria.ge/reports/230418-mg376acf41/
Behaviour
Modifies Internet Explorer settings
Script User-Agent
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Checks whether UAC is enabled
Enumerates connected drives
Looks up external IP address via web service
Checks BIOS information in registry
Executes dropped EXE
Loads dropped DLL
Themida packer
Blocklisted process makes network request
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Mekotio
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/a1e12d4289ff4d97268d309c68d94e9791c38e3963741391246fd4f351670feb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments