MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab67f9b2aba675e29dfde3beb40683ffdceb70b1237f43093aa94a20855d2e87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 8 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab67f9b2aba675e29dfde3beb40683ffdceb70b1237f43093aa94a20855d2e87
SHA3-384 hash: de3cd90891d5dc6f0098950c1ff5b0d8260ed3d4ac6ef10f3a57df83731cc7cbb9f495baa4d87c57b45fe3ddbdd6faf2
SHA1 hash: 52305ae15c459eb33e76c0df79622147e54b6ddb
MD5 hash: 14ff2a275e6994ba792d2733f35c410f
humanhash: butter-whiskey-timing-mexico
File name:14ff2a275e6994ba792d2733f35c410f
Download: download sample
File size:650'240 bytes
First seen:2024-10-25 07:46:40 UTC
Last seen:2024-10-25 10:45:08 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 56b6595b1315c0d123745ab0902e6aad
ssdeep 12288:MSB6YObJN3d0aH+5lR35CTxzcTo6cNs6IQy/lOljXtF9EO:MSE5JN3dVS/cTps19Olbt7EO
Threatray 12 similar samples on MalwareBazaar
TLSH T182D49E12798280F2D33B22364568F63A57BD79321A31CB9FABD81D3D6F305C17A25627
TrID 68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.5% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter zbetcheckin
Tags:32 dll exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
371
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Loader.2072.25769.30869.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=671b4cf8b39b9c1aa745f578
Tags:
Injection Exploit Agent
Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypto fingerprint microsoft_visual_cc
Link:
https://www.filescan.io/uploads/671b4cf8e09684501d7824ef/reports/3a9efd7f-fe91-4b2b-ba8e-1be9a2915a3a/overview
Verdict:
Malicious
Labled as:
Jaik.Generic
Link:
https://www.hybrid-analysis.com/sample/ab67f9b2aba675e29dfde3beb40683ffdceb70b1237f43093aa94a20855d2e87
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/0e24eff5-93a2-4297-9271-951487966644
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1541900
Signature
AI detected suspicious sample
Multi AV Scanner detection for submitted file
Sigma detected: Potential WinAPI Calls Via CommandLine
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1541900 Sample: FBO3NVXcYu.dll Startdate: 25/10/2024 Architecture: WINDOWS Score: 56 19 Multi AV Scanner detection for submitted file 2->19 21 AI detected suspicious sample 2->21 23 Sigma detected: Potential WinAPI Calls Via CommandLine 2->23 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        13 rundll32.exe 7->13         started        15 3 other processes 7->15 process5 17 rundll32.exe 9->17         started       
Score:
87%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ab67f9b2aba675e29dfde3beb40683ffdceb70b1237f43093aa94a20855d2e87
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab67f9b2aba675e29dfde3beb40683ffdceb70b1237f43093aa94a20855d2e87/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-10-24 19:41:05 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vnt7tmvluz26fhp54o7libud77oow4fren7ugcj2vffcbbk5f2dq._file
Verdict:
malicious
Label(s):
valleyrat
Create hunting rule
Similar samples:
13d50c5aaee30b965597d6af69b88038246f65deb4d2e0a5ca04394b47e5b16d
4f8d00852e6366df9fcf50894c4da8c55e3e1680d163231c5d1308479bca89b2
5d2351aa7fafc82d91dedcc0d24a6d986754259e0eb3c12007727ac2bf9039dd
a2b706961071bd4ed1bc50da62e257fb482769f3ed4b19a4b4388a1db5f089ff
ab67f9b2aba675e29dfde3beb40683ffdceb70b1237f43093aa94a20855d2e87
ad9513cf9a7f6a59bc7ed9a2bea44ec5e4bb655d18384336c0c124bfa2140286
error
+ 2 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/241025-jmh8dsxama/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
ab67f9b2aba675e29dfde3beb40683ffdceb70b1237f43093aa94a20855d2e87
MD5 hash:
14ff2a275e6994ba792d2733f35c410f
SHA1 hash:
52305ae15c459eb33e76c0df79622147e54b6ddb
Link:
https://www.unpac.me/results/121ec435-8720-46c0-95f1-5b909b051b4e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ab67f9b2aba675e29dfde3beb40683ffdceb70b1237f43093aa94a20855d2e87

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:pe_detect_tls_callbacks
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DLL dll ab67f9b2aba675e29dfde3beb40683ffdceb70b1237f43093aa94a20855d2e87

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3252702/
  
URLhaus
https://urlhaus.abuse.ch/url/3252700/
  
URLhaus
https://urlhaus.abuse.ch/url/3252703/
  
URLhaus
https://urlhaus.abuse.ch/url/3252708/
  
URLhaus
https://urlhaus.abuse.ch/url/3252705/
  
URLhaus
https://urlhaus.abuse.ch/url/3252709/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW

Comments


Avatar
zbet commented on 2024-10-25 07:46:41 UTC

url : hxxp://8.212.101.250/libemb.dll