MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a69036cd1bbf702c38423dda4ad3eef50af554b0a3dbcfdcd273dd5a3a27d18d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CIA


Vendor detections: 8


Intelligence 8 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a69036cd1bbf702c38423dda4ad3eef50af554b0a3dbcfdcd273dd5a3a27d18d
SHA3-384 hash: f4f5cbac0a645c3d9243b4c50d2fe017dd2eac56bdea3fb54cfddae8221a7f9912d2ce6c4279375fe29e3c8b84283570
SHA1 hash: d8e77cff676472549fc632dd95a984f574c5d2c3
MD5 hash: 355b1f0ecc6f21d424d290fd1cf8f9c4
humanhash: double-carbon-kentucky-island
File name:cia.windows.amd64.exe
Download: download sample
Signature CIA
Create hunting rule
File size:7'306'752 bytes
First seen:2022-12-10 05:39:08 UTC
Last seen:2022-12-10 07:27:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9cbefe68f395e67356e2a5d8d1b285c0 (58 x LummaStealer, 49 x AuroraStealer, 36 x Vidar)
ssdeep 98304:8GdevNlELLcfQmQQQQQQQQu4Y3RDbOcjySBCiSeMvHftJUCSZPt:8GUvYLgY4wtBVCVJQZPt
Threatray 26 similar samples on MalwareBazaar
TLSH T1B2767C03F89494A8C5E9D230C975D2A2BA317C840B3037D72F54BBBA2A77BD46E79351
gimphash 6418f88256ba60fb50fac0cbbc4d166a97db61b3fa2bc8fd161fe715d8f162da
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter petikvx
Tags:CIA exe Ransomware

Intelligence

File Origin
# of uploads :
2
# of downloads :
511
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/344874/
Detection(s):
SecuriteInfo.com.W64.Discord.I.gen.Eldorado.29637.25811.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Creating a file in the %temp% directory
Changing a file
Creating a file
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
golang greyware packed
Link:
https://www.filescan.io/uploads/63941bb7a2c2485912c7e467/reports/a999771f-addd-4bc4-b712-e37ab1cce6fc/overview
Result
Verdict:
MALICIOUS
Malware family:
ngrok-server
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/bcf99a4f-8c81-48ea-9fb7-ab49303a1d8c
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
troj
Score:
22 / 100
Link:
https://www.joesandbox.com/analysis/1131810
Signature
Performs DNS queries to domains with low reputation
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a69036cd1bbf702c38423dda4ad3eef50af554b0a3dbcfdcd273dd5a3a27d18d/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-12-10 05:40:14 UTC
File Type:
PE+ (Exe)
AV detection:
3 of 26 (11.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u2idnti3x5ycyocchxnevu7o6ufpkvfqupn47xgsopovuorh2ggq._file
Verdict:
unknown
Similar samples:
116eda3dadde2f047613ac43093e0b808a783713acd49e63d26674a63ab537f7
CIA
1e1910e710d721ff5b3eb050c47d963aac56df963ad2fbb5ff9decb47ce5e8b1
CIA
22de0c813bd5ad4cfd8ec3ec73a8b0bad8753ebb09bd0552d804048242225ebc
CIA
4c0f497c9c3eea31ac66ec955777c5ab4f0aa46774f3f779d7dcf914f2d19618
CIA
51e0e7e4fe62c83990f3f6d6e276f8bed4fd4a0cb8c50eb69fff6d57368e7d11
CIA
79d3cda3ddf9f7b2d8f94a733d06b8d21bb3c5dbcb77e1fe8a28f7ff87364447
CIA
94e55f1981d309c200304267e75948dde7cae6a852e2539650016c28d7575900
CIA
a7528fefccbb36949a97476e4717bc0af1359c13d028a5df6a5c8c8687d851e8
CIA
d0f9729789ebf3dccc68f2d2823ae00622145c646f5ccc1d8899ac1faffc249f
CIA
e90dc87153cee99a26b2b6beb37d7ea8e769b7d90c7e2dd8e3106c3c87571561
CIA
+ 16 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
ransomware
Link:
https://tria.ge/reports/221210-gcw1dsfa47/
Behaviour
GoLang User-Agent
Sets desktop wallpaper using registry
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f2cda9a7-922e-407c-a942-762a989a7853
Unpacked files
SH256 hash:
a69036cd1bbf702c38423dda4ad3eef50af554b0a3dbcfdcd273dd5a3a27d18d
MD5 hash:
355b1f0ecc6f21d424d290fd1cf8f9c4
SHA1 hash:
d8e77cff676472549fc632dd95a984f574c5d2c3
Link:
https://www.unpac.me/results/622f1c2a-166b-41c6-b694-3c9aee9dea8d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.49
Link:
https://yomi.yoroi.company/submissions/a69036cd1bbf702c38423dda4ad3eef50af554b0a3dbcfdcd273dd5a3a27d18d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_bin
Create hunting rule
Author:Jonathan Cole
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_build_id_strings
Create hunting rule
Author:Jonathan Cole
Description:Matches on string Golang build ID
Rule name:go_binary
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/344874/

Comments