MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab77c0f5e0b1863f8d45212d306c50504d1d3881c7f5295021fd8bb30d20c87b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ab77c0f5e0b1863f8d45212d306c50504d1d3881c7f5295021fd8bb30d20c87b
SHA3-384 hash:	1c2158eed1623214a7ead64140366c54aec0eac8a16fa5859e00b901a18514b04f0e054717dfd3d2e8eede22da829f4a
SHA1 hash:	7dfda46e8496191bee3fc556d821dca0399ec206
MD5 hash:	fa278a0145ec82c72d8914bff3b393c7
humanhash:	alabama-neptune-ohio-lion
File name:	fa278a0145ec82c72d8914bff3b393c7.exe
Download:	download sample
File size:	1'752'504 bytes
First seen:	2023-07-22 08:23:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	aac51396886833dc961fcd7aab7711e4 (11 x NetSupport, 7 x DCRat, 4 x njrat)
ssdeep	24576:PgZXoZUTVdt7K7UbU2Rw3DyYIq/+MaVZperbYYpk5x/8L1H017nv93WETi9ntvPX:u5hwz7/+tz//8hH0pnF3WETi9tdtD
Threatray	572 similar samples on MalwareBazaar
TLSH	T1ED85234177C18AB1E0631A336E299F21A73DBD301F3A8ECB6390741D9E615C19B37B66
TrID	91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) 0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	abuse_ch
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

257

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

fa278a0145ec82c72d8914bff3b393c7.exe

Verdict:

Malicious activity

Analysis date:

2023-07-22 08:25:59 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/8e09dcf2-9699-421e-be05-1ccd65a88254

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/428424/

ClamAV Detected

Detection(s):

SecuriteInfo.com.IL.Trojan.MSILZilla.Azorult.1690.11500.26808.UNOFFICIAL

Alert

Create hunting rule

FileScan.io

Gathering data

Hybrid Analysis Trojan.Ciusky.Generic

Verdict:

Malicious

Labled as:

Trojan.Ciusky.Generic

Link:

https://www.hybrid-analysis.com/sample/ab77c0f5e0b1863f8d45212d306c50504d1d3881c7f5295021fd8bb30d20c87b

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9f8eb833-b7b1-4d46-9b5d-bb02948abcb6

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1277712

Signature

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ab77c0f5e0b1863f8d45212d306c50504d1d3881c7f5295021fd8bb30d20c87b/

ReversingLabs TitaniumCloud Win32.Trojan.Ciusky

Threat name:

Win32.Trojan.Ciusky

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-21 06:58:36 UTC

File Type:

PE (Exe)

Extracted files:

18

AV detection:

13 of 25 (52.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vn34b5pawgdd7dkfeewta3cqkbgr2oeby72ssubb7wf3gdjazb5q._file

Threatray malicious

Verdict:

malicious

Similar samples:

33e686777d4e60947c1bc7d7743f006901dd209ae7fa9c6bd3d758dfc9b0aafc

35e5460c102ca2f996d61d70d6bb06fb87014f7d2beccf35f3812ea534acd9d5

36194d07ea9897f2276215a1361291ba8e32843caf3056b4f096c213b1bfadb3

8525d0bc1e38bb74d592de9be2615da94ec0b81e611b0e456b3a51c40ab5baa3

bfbe18d15b02ca49b998ced257354495d126513f86e26b8ad6dbe1db9cd568bf

e905f262f2ec981ddf92c94fe44d96c14195f9bf0815f204c2c4197b16dbb053

f8a021222ad2ca32a7b3562f643d95401efca4ccd44c814f6107a0c828bee235

f9430ec41806761aa165e278d49ed76349c5dd0592509ae0aed70bc74fe2f083

fba557d1ea30dc5810637b80408cc8d6491f33e5cb4def703f2b3413d476d93d

+ 562 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230722-kap1vaae6v/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Drops file in System32 directory

Checks computer location settings

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

889617e911b86a1d83d275d7d2c458ab7ad8f85780d8dfcede21d5b0fcd37449

MD5 hash:

47d87dea2c3424952e4e354b5fb339d0

SHA1 hash:

1b878fd8f00742ca905629108992f38270e55628

Link:

https://www.unpac.me/results/058a7119-5d40-486c-b0d0-9beeabac1649/

SH256 hash:

ab77c0f5e0b1863f8d45212d306c50504d1d3881c7f5295021fd8bb30d20c87b

MD5 hash:

fa278a0145ec82c72d8914bff3b393c7

SHA1 hash:

7dfda46e8496191bee3fc556d821dca0399ec206

Link:

https://www.unpac.me/results/058a7119-5d40-486c-b0d0-9beeabac1649/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ab77c0f5e0b1863f8d45212d306c50504d1d3881c7f5295021fd8bb30d20c87b

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/428424/