MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1e401e1461e63a4cfea1b5bfaf96a8d33c09776b8828ac976bf878eb04ab763. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a1e401e1461e63a4cfea1b5bfaf96a8d33c09776b8828ac976bf878eb04ab763
SHA3-384 hash:	6e62bb1d731ec03ca9da9a114f1f64003032e3654266ca061440272c693d002e91acd64f7ca5230b98dd403436ba6288
SHA1 hash:	e70cc4f49e8f09a6f12b880d800c525611afd71f
MD5 hash:	2f67444eb62ea7e3e13a4e69ecf4728a
humanhash:	edward-maine-johnny-video
File name:	nexty-1.5.3.rar
Download:	download sample
File size:	74'612'378 bytes
First seen:	2023-12-10 09:20:46 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	1572864:P4vxEpeZeWGnMAlpvNOzc2VoBnhAYxybZ7igbSl3E3Tgw3M29m1VbS:7fW4MAL0zcgoNhgZfTlZgDS
TLSH	T18EF733188ABACF284C67760A0C5AF660E13919D203DF3D3E9ECD3A7E827A145977D315
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	Xev
Tags:	BbyStealer rar

NIXLovesCooper

C2: rufflesrefined.com

Distributed via: https://nextyvpn.com/
https://nextyvpn.com/download/nexty-1.5.3.rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

77

Origin country :

GR

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Potential files of interest 1

File name:	nexty-1.5.3.exe
File size:	74'736'488 bytes
SHA256 hash:	01b4c0260a1f991fa4a1e1b82a6c1cd52e3f57bb64aa9f2278f3b23aab86f3f6
MD5 hash:	69716e71b3f817cb8927e824f5df04be
MIME type:	application/x-dosexec

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

control installer lolbin masquerade overlay packed shell32

Link:

https://www.filescan.io/uploads/657583028b5ba47db2dbfec8/reports/23f0402a-c2a7-4494-aa1e-7b85285e975b/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/a1e401e1461e63a4cfea1b5bfaf96a8d33c09776b8828ac976bf878eb04ab763

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uhsadykgdzr2jt7kdnn7v6lkruz4bf3wxcbivslwx6dy5mckw5rq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/231210-lfb7lsedf5/

Behaviour

Enumerates processes with tasklist

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.