MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8
SHA3-384 hash: 42ca95fa1b56f6a7d4ef5c47748460fc6aff9506e978219320947b36a891047aa69e739720986f6d0f1db334da7908cd
SHA1 hash: 696f6ac59432e6ca330e8023f6cb0fca4da0abb4
MD5 hash: e830ca46a6570c47e647d40f43e38e6d
humanhash: nine-fourteen-nevada-october
File name:e830ca46a6570c47e647d40f43e38e6d.exe
Download: download sample
File size:2'039'543 bytes
First seen:2023-10-16 08:14:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1d0e3506c01cb61e9312cbea4911e92e
ssdeep 49152:WfqjbDe8NVYVkmDAsJpOxzSMBb3rtvyUb1LaF:WwbDe8D6kaYzSMB7rtaU4F
Threatray 28 similar samples on MalwareBazaar
TLSH T14795231232E4C4FEC5925633829B2FF683E6D32B277598F36348CE195B74681877918E
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10523/12/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
268
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e830ca46a6570c47e647d40f43e38e6d.exe
Verdict:
Malicious activity
Analysis date:
2023-10-16 08:19:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/635b7360-d217-4119-b356-3014e04e00ae

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/454749/
Detection(s):
Win.Packed.Babar-10011011-0
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Running batch commands
Launching a process
Сreating synchronization primitives
Creating a process with a hidden window
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
installer lolbin overlay packed sfx shell32
Link:
https://www.filescan.io/uploads/652cf10d5da218a42f50fd4b/reports/ce664014-7739-4cd5-ac66-1f214d837c5b/overview
Verdict:
Malicious
Labled as:
Dropper.Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/daceb09f-699d-4496-9dd3-b22f66fdc550
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1326284
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1326284 Sample: dChV5mBabx.exe Startdate: 16/10/2023 Architecture: WINDOWS Score: 64 27 Multi AV Scanner detection for dropped file 2->27 29 Multi AV Scanner detection for submitted file 2->29 31 Machine Learning detection for sample 2->31 33 Machine Learning detection for dropped file 2->33 10 dChV5mBabx.exe 3 2->10         started        process3 file4 25 C:\Users\user\AppData\Local\...\29qkK.4yH, PE32 10->25 dropped 13 cmd.exe 1 10->13         started        process5 process6 15 control.exe 1 13->15         started        17 conhost.exe 13->17         started        process7 19 rundll32.exe 15->19         started        process8 21 rundll32.exe 19->21         started        process9 23 rundll32.exe 21->23         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2023-10-15 05:12:59 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uimzsdtoyl3o2ikau7atkih2uubumvesddycxwqagir5jaqzg7ea._file
Verdict:
malicious
Similar samples:
088c8f0e3190144e9f10d5f100a713310b8cd52c0c1804f677e9e82afd302323
0c5b80aed5a6781ee44add3021fdc566018cd342b6025a835a8ba053ed940e9e
5d4111d129f9502329b4da06459f6bfbc4c55a9bd033d8cd4566cb4018887162
5da0e9654b321dbbf3fcddafb175f360658d859b9ee5e166b017818349e416ff
71cee2ccfe6e1198949c920b69503a096154b67c04569669f4597837d3ef1e69
84ab4814962af3d7f7e8927c20ced3f4c3cb5c6614e6e2bdb707318cf4499e11
863459003cb750f92ebb22dab8a6964b55244194c7f464db81c35b2359d7678d
b6c7f66593503ce7de53dec372a3407ab0c0ed221007eac96e44dd9b9488df0d
e7f0a03d34cf93e1dc0bc78b4d08436de180e22fada1628810873683b9b2ee73
eba06c3f9929f4c7faf7781e2eb438ceffa9836f7241606900eb6815ee46ff06
+ 18 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/231016-j5ktyacg5y/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Unpacked files
SH256 hash:
96c70cf66c95e4b872e2df58d37c11948b55d0c40c6db3d2f005d8f5b09dcc5e
MD5 hash:
88399541a16132745ba8c752cec578ad
SHA1 hash:
9b7920fe2363f9e7f1c9d8b5324790ae1f4f0310
Link:
https://www.unpac.me/results/ae4b41ef-4a17-412d-8ae4-362c22e3ae11/
SH256 hash:
a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8
MD5 hash:
e830ca46a6570c47e647d40f43e38e6d
SHA1 hash:
696f6ac59432e6ca330e8023f6cb0fca4da0abb4
Link:
https://www.unpac.me/results/ae4b41ef-4a17-412d-8ae4-362c22e3ae11/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/454749/
  
URLhaus
https://urlhaus.abuse.ch/url/2715154/
  
Delivery method
Distributed via web download

Comments