MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4b553e1924688bd6232633b707797ba24efc75f6d7bc0a33cd9c0c00c910e19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4b553e1924688bd6232633b707797ba24efc75f6d7bc0a33cd9c0c00c910e19
SHA3-384 hash: cff5fce81ce9ac4c73f51a25c005ab4779e0575ac7de172867f89e2d1369338348026d1600c131ed54b70f8cf5ccb9f4
SHA1 hash: 5a2f8aba24846c7f81a069573d93795710dbcb44
MD5 hash: 38fe7c82d2a10cb943dc658125fc8e26
humanhash: fanta-carpet-chicken-kansas
File name:SecuriteInfo.com.Trojan.Packed.2301.5432.31761
Download: download sample
File size:8'642'560 bytes
First seen:2023-07-09 06:27:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 87095da59c785793cfa0c1760ce1dfbb
ssdeep 98304:pXn+PDa1N8RF/+Y0L0vmJBAUZL+x+KwWJxZaU:QPDlF/+YSbJV/4p
Threatray 1 similar samples on MalwareBazaar
TLSH T16A96E148FB1797A6E3C6E5F29F79616C37EA7DC289D4690FE29C39A20CB071451C80E1
TrID 19.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.2% (.EXE) UPX compressed Win32 Executable (27066/9/6)
16.9% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
10.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
8.3% (.SCR) Windows screen saver (13097/50/3)
File icon (PE):PE icon
dhash icon 004d2b2b0f6b4914
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.Packed.2301.5432.31761
Verdict:
Malicious activity
Analysis date:
2023-07-09 06:49:06 UTC
Tags:
trojan
Link:
https://app.any.run/tasks/393f6685-427c-4dd6-b5c5-d988583dd5c1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/412244/
Detection(s):
SecuriteInfo.com.Trojan.Packed.2301.5432.31761.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for analyzing tools
Creating a window
Creating a file
Searching for synchronization primitives
DNS request
Sending an HTTP GET request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
explorer lolbin packed stealer
Link:
https://www.filescan.io/uploads/64aa5384dbb9e835463f3692/reports/d82682e2-009b-460f-ad23-18cba85ee43c/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/a4b553e1924688bd6232633b707797ba24efc75f6d7bc0a33cd9c0c00c910e19
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/97d9935c-7c60-40d7-a51c-76706e13336f
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1271124
Signature
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4b553e1924688bd6232633b707797ba24efc75f6d7bc0a33cd9c0c00c910e19/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=us2vhymsi2el2yrsmm5xa54xxiso7r27nv54biz43hamaderbymq._file
Verdict:
unknown
Similar samples:
5c46967283614668bec2472cc6c95a8983ac5e78cc7c03db2242cdc026d9159b
Result
Malware family:
n/a
Score:
  7/10
Tags:
upx
Link:
https://tria.ge/reports/230709-g8cavsbf8y/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
UPX packed file
Unpacked files
SH256 hash:
2ca653ca445f31b6ce154549db9cf63ada1cf684f4976c05ba524677c1f21392
MD5 hash:
baf56dc294e9f4f1a97d17c15af7585e
SHA1 hash:
1c4f422669196377829b1c7f90041be4ac9094d1
Link:
https://www.unpac.me/results/a228aeeb-a699-4221-b7d3-7a613ebe292b/
SH256 hash:
2ca653ca445f31b6ce154549db9cf63ada1cf684f4976c05ba524677c1f21392
MD5 hash:
baf56dc294e9f4f1a97d17c15af7585e
SHA1 hash:
1c4f422669196377829b1c7f90041be4ac9094d1
Link:
https://www.unpac.me/results/a228aeeb-a699-4221-b7d3-7a613ebe292b/
SH256 hash:
5c1f697eb7e72c3264160de69ef2fac44251b59b433bf8fb0865039124ee0a3d
MD5 hash:
663976ea2197b1357a3bb70a0d81355f
SHA1 hash:
916d0a71bfd57f7ea723eb70e273b88b7e422600
Link:
https://www.unpac.me/results/a228aeeb-a699-4221-b7d3-7a613ebe292b/
SH256 hash:
5c1f697eb7e72c3264160de69ef2fac44251b59b433bf8fb0865039124ee0a3d
MD5 hash:
663976ea2197b1357a3bb70a0d81355f
SHA1 hash:
916d0a71bfd57f7ea723eb70e273b88b7e422600
Link:
https://www.unpac.me/results/a228aeeb-a699-4221-b7d3-7a613ebe292b/
SH256 hash:
a4b553e1924688bd6232633b707797ba24efc75f6d7bc0a33cd9c0c00c910e19
MD5 hash:
38fe7c82d2a10cb943dc658125fc8e26
SHA1 hash:
5a2f8aba24846c7f81a069573d93795710dbcb44
Link:
https://www.unpac.me/results/a228aeeb-a699-4221-b7d3-7a613ebe292b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a4b553e1924688bd6232633b707797ba24efc75f6d7bc0a33cd9c0c00c910e19

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/412244/

Comments