MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a256f95be0153ffd0deb5830f2108794321757ed0a44166147f7e3e646889979. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a256f95be0153ffd0deb5830f2108794321757ed0a44166147f7e3e646889979
SHA3-384 hash:	9b51aee6057c42c1227d7334603086f4a2e9d1d4de881b317f68bff378fec8819c9d723c917e1721e438f05e0017f259
SHA1 hash:	6273df22d79e7a2aa07aa445639c44be7f1a218a
MD5 hash:	2e3b50c64835b531ebde47b23cffcbe7
humanhash:	idaho-magazine-oranges-nine
File name:	00000000.exe
Download:	download sample
File size:	333'312 bytes
First seen:	2023-01-03 13:41:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ede8909d0925c770667cae9cf3798673
ssdeep	6144:tAAobu/K6eKIkRYZ9kSqp29ZGbpYByPT7lyvIcySIvF68fx:+AoUK6fIkQWB29vByPHly5VIvk8J
TLSH	T1AC64CFC4D2D359F5DC2319B0462BFBBF95302B424C31CEB6EB483686BE336626454B99
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	a2a9d8f88a88c9c0 (11 x SnakeKeylogger, 4 x RedLineStealer, 4 x AgentTesla)
Reporter	stoerchl
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

222

Origin country :

CH

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

00000000.exe

Verdict:

Malicious activity

Analysis date:

2023-01-03 13:42:22 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0d422202-919d-4ace-8875-9ea46abc1b4c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP GET request

Creating a file in the %AppData% directory

Launching a process

Deleting a recently created file

Reading critical registry keys

Searching for the window

Launching the default Windows debugger (dwwin.exe)

Forced system process termination

Stealing user critical data

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  2/10

Confidence:

100%

Tags:

anti-debug packed shell32.dll

Link:

https://www.filescan.io/uploads/63b430abbf1064ac5b2d8492/reports/c87b9b50-2fa0-414c-92a0-2a1fc8c69702/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/57064767-14dd-4f68-a511-2932ed6b5a4d

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1144550

Signature

Contain functionality to detect virtual machines

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to hide a thread from the debugger

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Searches for specific processes (likely to inject)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a256f95be0153ffd0deb5830f2108794321757ed0a44166147f7e3e646889979/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-01-03 13:42:07 UTC

File Type:

PE (Exe)

Extracted files:

10

AV detection:

14 of 26 (53.85%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ujlpsw7acu772dpllaypeeehsqzbov7nbjcbmykh67r6mruitf4q._file

Threatray unknown

Verdict:

unknown

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection discovery spyware stealer

Link:

https://tria.ge/reports/230103-qznf7seg7w/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

Accesses Microsoft Outlook profiles

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

UnpacMe

Unpacked files

SH256 hash:

a256f95be0153ffd0deb5830f2108794321757ed0a44166147f7e3e646889979

MD5 hash:

2e3b50c64835b531ebde47b23cffcbe7

SHA1 hash:

6273df22d79e7a2aa07aa445639c44be7f1a218a

Link:

https://www.unpac.me/results/710fb49d-86f3-467f-8d1a-172970545e8b/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a256f95be015/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a256f95be0153ffd0deb5830f2108794321757ed0a44166147f7e3e646889979