MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a55f21df2637efb363fe68d3801fdd1c25d097d9afeb54e1f7692ae85a909f6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a55f21df2637efb363fe68d3801fdd1c25d097d9afeb54e1f7692ae85a909f6e
SHA3-384 hash: c9a5de2bb78b03910fc65faaa4b20279125189961c3ce3c78c9d0fec742c50d406f457d7734c60035481dca53ee63c97
SHA1 hash: bdad3927c31aa0305ecd8e7b0f32947782cad6ae
MD5 hash: 8bd612016cec381d77a6acad887a4130
humanhash: floor-leopard-florida-island
File name:MEMO.exe
Download: download sample
File size:60'416 bytes
First seen:2024-07-30 15:30:00 UTC
Last seen:2024-07-30 16:48:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 1536:Q8kWC/6fic304HG2Yz+TKid4BOgBalaF5:Q8kkY4m2ld4BOGa85
TLSH T1A4431941B7A78A14C5046E33C59716040375DFC37A67DA4F389A335A4E733EF2A8A9CA
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon eccc8c94d4d8e8f4 (21 x Formbook, 15 x AgentTesla, 5 x Loki)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
374
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MEMO.exe
Verdict:
No threats detected
Analysis date:
2024-07-30 16:19:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bbf41eaf-b4bc-4062-bfa6-fbda96f0613d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66a907059d47c7700ac5fc11
Tags:
Network Static Stealth Dropper
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Connection attempt to an infection source
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Unknown
Threat level:
  10/10
Confidence:
100%
Tags:
net_reactor obfuscated packed
Link:
https://www.filescan.io/uploads/66a9070378d5c73fb1c94f1f/reports/e0bf201b-fe80-498b-aab2-b803c07185c9/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/a55f21df2637efb363fe68d3801fdd1c25d097d9afeb54e1f7692ae85a909f6e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7152a504-4d4a-4947-8345-c702f57df0e9
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1484793
Signature
.NET source code contains potential unpacker
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a55f21df2637efb363fe68d3801fdd1c25d097d9afeb54e1f7692ae85a909f6e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a55f21df2637efb363fe68d3801fdd1c25d097d9afeb54e1f7692ae85a909f6e/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2024-05-18 00:59:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uvpsdxzgg7x3gy76ndjyah65dqs5bf6zv7vvjypxnevoqwuqt5xa._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/240730-sxhjaawfrl/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/82bfcf5a-95da-4d13-97d2-9e457f8327a3
Unpacked files
SH256 hash:
a55f21df2637efb363fe68d3801fdd1c25d097d9afeb54e1f7692ae85a909f6e
MD5 hash:
8bd612016cec381d77a6acad887a4130
SHA1 hash:
bdad3927c31aa0305ecd8e7b0f32947782cad6ae
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/bc7e6e1d-9e69-455c-903c-181f09e611e8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a55f21df2637efb363fe68d3801fdd1c25d097d9afeb54e1f7692ae85a909f6e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments