MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa78693a6e988b4ef2cad9ea19dd2286f0d155efae6ffa27733036b9808ad3ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	aa78693a6e988b4ef2cad9ea19dd2286f0d155efae6ffa27733036b9808ad3ad
SHA3-384 hash:	b1325faa05c88cafd4dba6ee115393b071c21044f0bbb23601db675489d073f9b3f0700c649fa437ba06d9d6cd7f4cb7
SHA1 hash:	604c7d8a9e13309781116276640173e021360227
MD5 hash:	1a375991d58112bec0fd13f12bb8bc32
humanhash:	potato-johnny-may-red
File name:	yawcam.exe
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	5'331'648 bytes
First seen:	2023-12-24 07:13:55 UTC
Last seen:	2023-12-24 09:16:53 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'750 x AgentTesla, 19'653 x Formbook, 12'248 x SnakeKeylogger)
ssdeep	98304:eGuQg5bvUHSSceVgQLCbrdYeWZjPwUKk8GLpEXgGoSvXBieI4r2aVkzH1:mbvUySceVgbbr3WZjPwKQHr3If6c
TLSH	T16036330E87E76A36EA3C663504B042812F77B09531C1E6A62CF0EACE15F77E64871F65
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	70f0f0b0989ad870 (1 x PureLogsStealer, 1 x Formbook)
Reporter	adm1n_usa32
Tags:	exe PureLogStealer

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

315

Origin country :

RO

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/469168/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.10477.26665.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Launching a process

Creating a file

Сreating synchronization primitives

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Using the Windows Management Instrumentation requests

Forced system process termination

Detecting VM

Unauthorized injection to a system process

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

installer overlay packed

Link:

https://www.filescan.io/uploads/6587da3bb855eb3693f1d6f8/reports/89893a81-9917-4ff5-96cc-3340412b9580/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/aa78693a6e988b4ef2cad9ea19dd2286f0d155efae6ffa27733036b9808ad3ad

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer FlashDevelop

Malware family:

FlashDevelop

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/81792c23-ee2f-47cd-9394-908cfafc1182

Joe Sandbox PureLog Stealer, RHADAMANTHYS

Result

Threat name:

PureLog Stealer, RHADAMANTHYS

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1366616

Signature

.NET source code contains potential unpacker

Checks if the current machine is a virtual machine (disk enumeration)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected PureLog Stealer

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/aa78693a6e988b4ef2cad9ea19dd2286f0d155efae6ffa27733036b9808ad3ad

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aa78693a6e988b4ef2cad9ea19dd2286f0d155efae6ffa27733036b9808ad3ad/

ReversingLabs TitaniumCloud Win32.Trojan.Nekark

Threat name:

Win32.Trojan.Nekark

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-23 05:31:46 UTC

File Type:

PE (.Net Exe)

Extracted files:

19

AV detection:

17 of 37 (45.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vj4gsototcfu54wk3hvbtxjcq3yncvppvzx7uj3tga3ltaek2owq._file

Threatray malicious

Verdict:

malicious

Hatching Triage zgrat

Result

Malware family:

zgrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:rhadamanthys family:zgrat rat stealer

Link:

https://tria.ge/reports/231224-h2mzfsadcr/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Detect ZGRat V1

Rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

ZGRat

UnpacMe INDICATOR_EXE_Packed_Babel

Unpacked files

SH256 hash:

ea14032287348acc73e75b6054569d3095d2fca5a738b0ad394d2abcad2d0153

MD5 hash:

eff923751c9c23308ca6d4c7ba349e97

SHA1 hash:

ef08df53086db936e7a4a86c8734e20431a46394

Link:

https://www.unpac.me/results/284266c3-30bb-4d41-80e6-ca9a39769ca9/

SH256 hash:

421fbd76454841ec3fce37daab84c71da4fdd8b24cef841a63a9c4b15f9bcd09

MD5 hash:

7c9e711db52565e0930c89c89ffadab1

SHA1 hash:

a18ebfeb958359f7b55022569125b8268372cc97

Link:

https://www.unpac.me/results/284266c3-30bb-4d41-80e6-ca9a39769ca9/

SH256 hash:

cf7a7b9a09c8b8438977763bdd74a234e73a10d000fc632b2ee3dbf070d97b03

MD5 hash:

c019ac83ba1026a4be382d59e54176d9

SHA1 hash:

47da12717bdb145fa97461d6c871771f27d2b25f

Link:

https://www.unpac.me/results/284266c3-30bb-4d41-80e6-ca9a39769ca9/

SH256 hash:

dfbda8f7c70af63985668c12cbc0a1f96f395cd8f7a92a175fb6aac57208490a

MD5 hash:

8e8e2700601b8a2e040e81a466eae94a

SHA1 hash:

033fd3452575bf354f6d1e4220dae16bf707f312

Link:

https://www.unpac.me/results/284266c3-30bb-4d41-80e6-ca9a39769ca9/

SH256 hash:

aa78693a6e988b4ef2cad9ea19dd2286f0d155efae6ffa27733036b9808ad3ad

MD5 hash:

1a375991d58112bec0fd13f12bb8bc32

SHA1 hash:

604c7d8a9e13309781116276640173e021360227

Detections:

INDICATOR_EXE_Packed_Babel

Alert

Create hunting rule

Link:

https://www.unpac.me/results/284266c3-30bb-4d41-80e6-ca9a39769ca9/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/aa78693a6e98/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/aa78693a6e988b4ef2cad9ea19dd2286f0d155efae6ffa27733036b9808ad3ad

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Joe Sandbox

https://www.hybrid-analysis.com/sample/aa78693a6e988b4ef2cad9ea19dd2286f0d155efae6ffa27733036b9808ad3ad/6587d87182a4e6e98305f905

Cape

https://www.capesandbox.com/analysis/469168/