MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a32254cc825e4fd2bcc3c2dae2ca7fd17e50f387f96d23d019d9a7ae8f3372ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a32254cc825e4fd2bcc3c2dae2ca7fd17e50f387f96d23d019d9a7ae8f3372ec
SHA3-384 hash:	abc6de90f9ed715a13a81da3115a785b65736443e1bb469dad569abb13185fb420cef238932d0a63a0aca6508f3a9820
SHA1 hash:	52704f7057cf93790ea344506011625dc435d063
MD5 hash:	2e5c10224f9973ff0695bc76d57aa3dc
humanhash:	hamper-triple-eleven-venus
File name:	Planets Therapy Setup.exe
Download:	download sample
File size:	82'571'826 bytes
First seen:	2024-02-14 15:57:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (563 x GuLoader, 120 x RemcosRAT, 82 x EpsilonStealer)
ssdeep	1572864:ur6LBY8Oku1U8jp+2YQcxZHBFdNYZvpXm6IKEnvw:uyuLkp8NRkzFC3IKEv
TLSH	T1DE08336716457029F4693BF53E3DA9AEE628C5413B81A4F3BC8652CB8C418E7E81C47F
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.9% (.EXE) Win32 Executable (generic) (4504/4/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	c4dadadad2f492c2 (110 x GuLoader, 49 x RemcosRAT, 23 x VIPKeylogger)
Reporter	e24111111111111
Tags:	exe SrryStealer

e24111111154168

SrryStealer C2: serenys.xyz

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

365

Origin country :

GR

Vendor Threat Intelligence

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Searching for the window

Searching for the Windows task manager window

Running batch commands

Creating a process with a hidden window

Launching a process

Using the Windows Management Instrumentation requests

Creating a file

Creating a file in the %AppData% subdirectories

Changing a file

Creating a process from a recently created file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/65cce315bef28d0c6fb8707c/reports/332e76b6-94fd-448d-af26-16b15574d253/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/a32254cc825e4fd2bcc3c2dae2ca7fd17e50f387f96d23d019d9a7ae8f3372ec

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1392300

Signature

Drops large PE files

Performs DNS queries to domains with low reputation

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

25%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/a32254cc825e4fd2bcc3c2dae2ca7fd17e50f387f96d23d019d9a7ae8f3372ec

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=umrfjteclzh5fpgdylnofst72f7fb44h7fwshuaz3gt25dztolwa._file

Threatray unknown

Verdict:

unknown

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/240214-tehl1aeh4z/

Behaviour

Checks processor information in registry

Enumerates processes with tasklist

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks installed software on the system

Looks up external IP address via web service

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.