MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3ca8d72edaf4ffb84a38e88a31f9e537d7d7b76f7cc7966583c7b4b4a811c74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3ca8d72edaf4ffb84a38e88a31f9e537d7d7b76f7cc7966583c7b4b4a811c74
SHA3-384 hash: c379f2747886f363ab8a06c41d6141650dadcdfa4f292e6f6cf227279c9dabd44e15eabcac007774c4758359b30be2c2
SHA1 hash: ba2a264ac0773a804ab15da18ded3bc556cc99ce
MD5 hash: f64eadf97eacf0c639336617cf6af03b
humanhash: hydrogen-friend-cold-winter
File name:SecuriteInfo.com.Trojan.PWS.DiscordNET.51.19277.11840
Download: download sample
File size:2'901'504 bytes
First seen:2022-11-30 22:30:00 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 62 x CobaltStrike, 44 x JanelaRAT)
ssdeep 49152:TsLJjhwr1Bp6ErdSl0WXK99EYKauI1HIknog:TKJjhm1BptqXK
Threatray 108 similar samples on MalwareBazaar
TLSH T1D5D55A0937F85F33D57EE7B680B0845267F0E85AA323EB4B6981A7682D23B505D413B7
TrID 30.6% (.SCR) Windows screen saver (13097/50/3)
24.5% (.EXE) Win64 Executable (generic) (10523/12/4)
15.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win32 Executable (generic) (4505/5/1)
4.8% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/340792/
Detection(s):
SecuriteInfo.com.Trojan.PWS.DiscordNET.51.19277.11840.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PWS.DiscordNET.51.10182.23312.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6387d96fc2c8d19cd07c7873/reports/0af03c4e-f210-49be-a1e1-69290c55d9f3/overview
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/575e9767-8f37-4dbc-a6aa-a22c15b93357
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/1124558
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a3ca8d72edaf4ffb84a38e88a31f9e537d7d7b76f7cc7966583c7b4b4a811c74/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=upfi24xnv5h7xbfdr2ekgh46kn6x263w67ghszsyhr5uwsubdr2a._file
Verdict:
malicious
Similar samples:
2318ae5d7c23bf186b88abecf892e23ce199381b22c8eb216ad1616ee8877933
9121fd4845cbfaf6036ecd3d457eabb2baba660eb693d317eba3c97dccc55a64
a4165ae334a45cd8cf05b1659650d61380854fe3e8369df4cfd47cdb71596303
c6af2ec456ad02b9eb3faf9fd9384d3dc43a55e7b1a58eec4440ee4bde1e99ce
e5c85df9a9b6f84f76c64b41c07a4f52f16a373eae80c713765a5cf43ced3e8d
+ 98 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/221130-2ety2aed3v/
Unpacked files
SH256 hash:
a3ca8d72edaf4ffb84a38e88a31f9e537d7d7b76f7cc7966583c7b4b4a811c74
MD5 hash:
f64eadf97eacf0c639336617cf6af03b
SHA1 hash:
ba2a264ac0773a804ab15da18ded3bc556cc99ce
Link:
https://www.unpac.me/results/442ae3f9-67e4-4b48-91aa-616cfc13eab2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a3ca8d72edaf4ffb84a38e88a31f9e537d7d7b76f7cc7966583c7b4b4a811c74

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DLL dll a3ca8d72edaf4ffb84a38e88a31f9e537d7d7b76f7cc7966583c7b4b4a811c74

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/340792/
  
URLhaus
https://urlhaus.abuse.ch/url/2440082/
  
Delivery method
Distributed via web download

Comments