🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a83e4d482b1e12406bc6d4809623b3dff088dd30406d4a7bc1fbae009a0d7207. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a83e4d482b1e12406bc6d4809623b3dff088dd30406d4a7bc1fbae009a0d7207
SHA3-384 hash: 9d3749853655671dc7e0ef82fd45c21acc3a3a53d1b8ddaf6499e60e10799d393ccb1a6033822b1b35c02190933e2b7c
SHA1 hash: c57c66f2d29d8f85ed4d3a348d6a7cc76105a43b
MD5 hash: 81c4e0d97b822d5d2802b6ecec9af8bf
humanhash: white-cardinal-michigan-lamp
File name:CloudCheck.exe
Download: download sample
File size:7'299'512 bytes
First seen:2023-10-29 04:24:32 UTC
Last seen:2023-10-29 05:53:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 489c6e87495e62f21e8bc92d686aff0a
ssdeep 49152:kwUJewPxCrMlyV5dIlrcqtLYh7GbxzIklR/Hymibmhc9KqtpOlHJ7SwoLbPhSzz:kw2gCLYhukM
Threatray 4 similar samples on MalwareBazaar
TLSH T13D764AAE60A88A7BC24AC635C0FF9F31E531B1952933C3AA1650C3B56F27160DD7F661
TrID 52.0% (.EXE) InstallShield setup (43053/19/16)
15.8% (.SCR) Windows screen saver (13097/50/3)
12.7% (.EXE) Win64 Executable (generic) (10523/12/4)
12.0% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 8249d8941380c000 (11 x MofongoLoader)
Reporter SAppStudio
Tags:exe signed

Code Signing Certificate

Organisation:HardestCodesEst OU
Issuer:Certum Extended Validation Code Signing 2021 CA
Algorithm:sha256WithRSAEncryption
Valid from:2023-08-19T06:24:10Z
Valid to:2024-08-18T06:24:09Z
Serial number: 66b650d54e8beb5e0777d386e59d9b65
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 1637e45f1a11b69ab32169ec3bf609e0c173bbcb31d4fe11f8e998993e213810
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
355
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/456871/
Detection(s):
SecuriteInfo.com.Trojan.Siggen21.46520.17251.3.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Sending an HTTP GET request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control explorer greyware keylogger lolbin overlay packed phishing remote replace
Link:
https://www.filescan.io/uploads/653dde9f4ebf05ac3f3d7d34/reports/8a4ce80a-e099-41f8-a785-bc2984ea52e7/overview
Verdict:
Malicious
Labled as:
Trojan.Win64.Agentb
Link:
https://www.hybrid-analysis.com/sample/a83e4d482b1e12406bc6d4809623b3dff088dd30406d4a7bc1fbae009a0d7207
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e10c4742-38f3-4b70-bead-d1392bcc943b
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1333784
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
0%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/a83e4d482b1e12406bc6d4809623b3dff088dd30406d4a7bc1fbae009a0d7207
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a83e4d482b1e12406bc6d4809623b3dff088dd30406d4a7bc1fbae009a0d7207/
Threat name:
Win64.Adware.RedCap
Create hunting rule
Status:
Malicious
First seen:
2023-10-29 04:25:07 UTC
File Type:
PE+ (Exe)
Extracted files:
38
AV detection:
7 of 23 (30.43%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=va7e2sbldyjea26g2sajmi5t37yirxjqibwuu66b7oxabgqnoidq._file
Verdict:
unknown
Similar samples:
15b5552337689004a2489aa0c9e1b00bc8bfc624aa251e2cc296c571fc1d12ce
6c756c380d5186e1a868ccd6535f03ad89ee1c6af5b933e29130efd9381260a4
91d7d387c8d1cac4ead0a0613e1dd505dd49a43083f759bd843bb936a502b4a8
af49eebde405cbfeb5003747f48622d2c1292a3eba28b52eaba68532a63d1e02
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/231029-e1yssagd24/
Behaviour
Modifies system certificate store
Unpacked files
SH256 hash:
a83e4d482b1e12406bc6d4809623b3dff088dd30406d4a7bc1fbae009a0d7207
MD5 hash:
81c4e0d97b822d5d2802b6ecec9af8bf
SHA1 hash:
c57c66f2d29d8f85ed4d3a348d6a7cc76105a43b
Link:
https://www.unpac.me/results/1baae42f-9a5e-49ca-a398-9df9ef41908a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.31
Link:
https://yomi.yoroi.company/submissions/a83e4d482b1e12406bc6d4809623b3dff088dd30406d4a7bc1fbae009a0d7207

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/456871/

Comments