MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8
SHA3-384 hash:	42ca95fa1b56f6a7d4ef5c47748460fc6aff9506e978219320947b36a891047aa69e739720986f6d0f1db334da7908cd
SHA1 hash:	696f6ac59432e6ca330e8023f6cb0fca4da0abb4
MD5 hash:	e830ca46a6570c47e647d40f43e38e6d
humanhash:	nine-fourteen-nevada-october
File name:	e830ca46a6570c47e647d40f43e38e6d.exe
Download:	download sample
File size:	2'039'543 bytes
First seen:	2023-10-16 08:14:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1d0e3506c01cb61e9312cbea4911e92e
ssdeep	49152:WfqjbDe8NVYVkmDAsJpOxzSMBb3rtvyUb1LaF:WwbDe8D6kaYzSMB7rtaU4F
Threatray	28 similar samples on MalwareBazaar
TLSH	T14795231232E4C4FEC5925633829B2FF683E6D32B277598F36348CE195B74681877918E
TrID	33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 21.3% (.EXE) Win64 Executable (generic) (10523/12/4) 13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	848c5454baf47474 (2'466 x Adware.Neoreklami, 103 x RedLineStealer, 65 x N-able)
Reporter	abuse_ch
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

268

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

e830ca46a6570c47e647d40f43e38e6d.exe

Verdict:

Malicious activity

Analysis date:

2023-10-16 08:19:21 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/635b7360-d217-4119-b356-3014e04e00ae

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/454749/

ClamAV Detected

Detection(s):

Win.Packed.Babar-10011011-0

Alert

Create hunting rule

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% subdirectories

Running batch commands

Launching a process

Сreating synchronization primitives

Creating a process with a hidden window

Dragonfly

Gathering data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

installer lolbin overlay packed sfx shell32

Link:

https://www.filescan.io/uploads/652cf10d5da218a42f50fd4b/reports/ce664014-7739-4cd5-ac66-1f214d837c5b/overview

Hybrid Analysis Dropper.Trojan.Generic

Verdict:

Malicious

Labled as:

Dropper.Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/daceb09f-699d-4496-9dd3-b22f66fdc550

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1326284

Signature

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8/

ReversingLabs TitaniumCloud Win32.Trojan.Zenpak

Threat name:

Win32.Trojan.Zenpak

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-15 05:12:59 UTC

File Type:

PE (Exe)

Extracted files:

9

AV detection:

18 of 38 (47.37%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uimzsdtoyl3o2ikau7atkih2uubumvesddycxwqagir5jaqzg7ea._file

Threatray malicious

Verdict:

malicious

Similar samples:

088c8f0e3190144e9f10d5f100a713310b8cd52c0c1804f677e9e82afd302323

0c5b80aed5a6781ee44add3021fdc566018cd342b6025a835a8ba053ed940e9e

5d4111d129f9502329b4da06459f6bfbc4c55a9bd033d8cd4566cb4018887162

5da0e9654b321dbbf3fcddafb175f360658d859b9ee5e166b017818349e416ff

71cee2ccfe6e1198949c920b69503a096154b67c04569669f4597837d3ef1e69

84ab4814962af3d7f7e8927c20ced3f4c3cb5c6614e6e2bdb707318cf4499e11

863459003cb750f92ebb22dab8a6964b55244194c7f464db81c35b2359d7678d

b6c7f66593503ce7de53dec372a3407ab0c0ed221007eac96e44dd9b9488df0d

e7f0a03d34cf93e1dc0bc78b4d08436de180e22fada1628810873683b9b2ee73

eba06c3f9929f4c7faf7781e2eb438ceffa9836f7241606900eb6815ee46ff06

+ 18 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/231016-j5ktyacg5y/

Behaviour

Suspicious use of WriteProcessMemory

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

96c70cf66c95e4b872e2df58d37c11948b55d0c40c6db3d2f005d8f5b09dcc5e

MD5 hash:

88399541a16132745ba8c752cec578ad

SHA1 hash:

9b7920fe2363f9e7f1c9d8b5324790ae1f4f0310

Link:

https://www.unpac.me/results/ae4b41ef-4a17-412d-8ae4-362c22e3ae11/

SH256 hash:

a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8

MD5 hash:

e830ca46a6570c47e647d40f43e38e6d

SHA1 hash:

696f6ac59432e6ca330e8023f6cb0fca4da0abb4

Link:

https://www.unpac.me/results/ae4b41ef-4a17-412d-8ae4-362c22e3ae11/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe a219990e6ec2f6ed2140a7c13520faa50346549218f02bda003223d4821937c8

(this sample)

Cape

https://www.capesandbox.com/analysis/454749/

  

URLhaus

https://urlhaus.abuse.ch/url/2715154/

  

Delivery method

Distributed via web download