MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acb6ddc1461c0d9e81f482f4e5738f330d01f0365b6f95e44aa5792fbe8d7376. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: acb6ddc1461c0d9e81f482f4e5738f330d01f0365b6f95e44aa5792fbe8d7376
SHA3-384 hash: 3fe9c307531f3eef384195b7ccedc11de8edd03c429c8881fc606d6f93b3405f6ef77664417c3a9227c866e596aec455
SHA1 hash: 3a988fa22b773f15617f567de6ff67c2cede1f4a
MD5 hash: 5e39b762fc6701d35f1dbc2332238be1
humanhash: south-cold-mobile-mobile
File name:game_installer.exe
Download: download sample
File size:12'973'831 bytes
First seen:2022-08-16 13:35:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1e92fd54d65284238a0e3b74b2715062 (21 x Empyrean, 4 x Gh0stRAT, 4 x Telemiris)
ssdeep 393216:WxdyJhoonMvgpEL2Vmd6m6MBktCw+MJjlnsJFa:WzyJ+UWgpEyVmd4kV96jKJo
Threatray 32 similar samples on MalwareBazaar
TLSH T1C8D6335066E029C9F1BA583AE4EF7527C5D9B43A5B14E34F4360D12A1EB336298B7F30
TrID 66.5% (.EXE) InstallShield setup (43053/19/16)
16.2% (.EXE) Win64 Executable (generic) (10523/12/4)
7.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.1% (.EXE) OS/2 Executable (generic) (2029/13)
3.0% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon c6c2ccc4f4e0e0f8 (37 x PythonStealer, 21 x CrealStealer, 19 x Empyrean)
Reporter JaffaCakes118
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
243
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
game_installer.exe
Verdict:
No threats detected
Analysis date:
2022-08-16 13:34:26 UTC
Tags:
installer
Link:
https://app.any.run/tasks/e4f676fc-f2bf-43e9-922b-bbfb1da1654d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/299018/
Detection(s):
SecuriteInfo.com.Trojan.Agent.Script.1713931.10438.20114.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Creating a file
Changing a file
DNS request
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/29114/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/62fb9d477a5eee5048109c60/reports/850bc78a-fca4-4939-a720-17bca34a0937/overview
Result
Verdict:
MALICIOUS
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b33eeee4-b165-4099-9eaf-0e498273152c
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1052315
Signature
Contains functionality to infect the boot sector
Hides threads from debuggers
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 684831 Sample: game_installer.exe Startdate: 16/08/2022 Architecture: WINDOWS Score: 56 27 Multi AV Scanner detection for submitted file 2->27 8 game_installer.exe 99 2->8         started        process3 file4 19 C:\Users\...\_quoting_c.cp310-win_amd64.pyd, PE32+ 8->19 dropped 21 C:\Users\user\AppData\...\win32crypt.pyd, PE32+ 8->21 dropped 23 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 8->23 dropped 25 78 other files (none is malicious) 8->25 dropped 29 Contains functionality to infect the boot sector 8->29 12 game_installer.exe 8->12         started        signatures5 process6 signatures7 31 Hides threads from debuggers 12->31 15 cmd.exe 1 12->15         started        process8 process9 17 conhost.exe 15->17         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/acb6ddc1461c0d9e81f482f4e5738f330d01f0365b6f95e44aa5792fbe8d7376/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vs3n3qkgdqgz5apuql2ok44pgmgqd4bwlnxzlzckuv4s7punon3a._file
Verdict:
suspicious
Similar samples:
329d77b0ab5af0e568b9d56e3c3f7afc4266bf2cea0bd816ed4e67d4c9a09692
414d8e74cdb96fe1e8742018494be41cdebd5c11804a30a7876a5bcd7bf01764
476a05d5c8ef4444f96cbd02c3a315c56227b7510f75e82249a449bb79e977fc
4b56d8713523dea09695ec6beef98608c234e5f8a9be77be931a687c080fb0f1
5a84910606ad80acd72e15856c704e0a044f93d46df482d5629d4cc2c55d546b
a07afb3f48c05bc311adc6a9473310e6b35e14f14920e543ee8ca032a0af637f
af828a7abf4cb31d7e12b5a2e45e99e5009f3c9f5cefe0760fa0ab880f642794
b000ebdd1ec391024c2d6a953a56485a5460ca449b419bb2380f210620d72dae
b8e807fd68dc28227145b1fed9a72e925c24ab76495dce4733e9656740732b1b
d18e18eeee28b729ec305ddbafd393f3b36a8e5d6a3ba66d8c6d0eb6a1a210d0
+ 22 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller spyware stealer
Link:
https://tria.ge/reports/220816-qv8xcaceh7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
acb6ddc1461c0d9e81f482f4e5738f330d01f0365b6f95e44aa5792fbe8d7376
MD5 hash:
5e39b762fc6701d35f1dbc2332238be1
SHA1 hash:
3a988fa22b773f15617f567de6ff67c2cede1f4a
Link:
https://www.unpac.me/results/46c5558d-819b-4385-b284-8e7b6616e785/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/acb6ddc1461c0d9e81f482f4e5738f330d01f0365b6f95e44aa5792fbe8d7376

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe acb6ddc1461c0d9e81f482f4e5738f330d01f0365b6f95e44aa5792fbe8d7376

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/299018/

Comments