MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 add2ade24a91060f68861cf95604a7e1910849b67b255e5caec98e57919b1b2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 14


Intelligence 14 IOCs YARA 17 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: add2ade24a91060f68861cf95604a7e1910849b67b255e5caec98e57919b1b2c
SHA3-384 hash: 6501b4a723a15866456c073a8dc85978dac02435c0d9c66d600e55df1929a1a59854a29c5c0cdc1280d85db3a5557e7b
SHA1 hash: 6811c0c3eb6dcee7842f2ed1dc834c478de90ba7
MD5 hash: f9a10faa0b2159b8f2e99f013be6c24b
humanhash: twelve-carbon-edward-march
File name:f9a10faa0b2159b8f2e99f013be6c24b
Download: download sample
File size:8'750'737 bytes
First seen:2024-10-19 05:00:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1af6c885af093afc55142c2f1761dbe8 (49 x PythonStealer, 40 x BlankGrabber, 14 x LunaLogger)
ssdeep 196608:F2QQoqBtPcH/8zFdQmRJ8dA6lmCy1ArqkVpKCX+PrF4ZIeghn3YpwM:EfowtPcHU5dQuslmrAZYCuPJOIegBa
TLSH T157962216B29610EDD06EC178C7565112E970BC815B30BAEF17A8572A2F23FD06F3EB25
TrID 72.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
13.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.5% (.EXE) OS/2 Executable (generic) (2029/13)
2.5% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter zbetcheckin
Tags:64 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
357
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f9a10faa0b2159b8f2e99f013be6c24b
Verdict:
Malicious activity
Analysis date:
2024-10-19 05:02:39 UTC
Tags:
discord evasion python pyinstaller ims-api generic crypto-regex
Link:
https://app.any.run/tasks/4d835c68-9348-4f5d-8f96-6b7d35be9b55

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Keylogger.Python-9978779-0
Create hunting rule

SecuriteInfo.com.FileRepMalware.20232.10778.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67133d10e706a56b5a02f5fb
Tags:
Powershell Vmdetect
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Restart of the analyzed sample
Running batch commands
Creating a process with a hidden window
DNS request
Connection attempt
Sending a custom TCP request
Creating a file in the %AppData% directory
Searching for the window
Using the Windows Management Instrumentation requests
Creating a process from a recently created file
Launching a tool to kill processes
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
chacha compiled-script expand fingerprint lolbin microsoft_visual_cc monero obfuscated overlay packed packed packed packer_detected pyinstaller pyinstaller remote shell32 stealer
Link:
https://www.filescan.io/uploads/67133d0fb8693873ac83f8d0/reports/b006b506-5021-4719-beea-3b95e0122e28/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/add2ade24a91060f68861cf95604a7e1910849b67b255e5caec98e57919b1b2c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
PuTTY
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/16a948e7-ebc8-4a1a-86a6-2e5715552d65
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1537541
Signature
AI detected suspicious sample
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1537541 Sample: Ff0ZjqSI9Y.exe Startdate: 19/10/2024 Architecture: WINDOWS Score: 68 110 time.windows.com 2->110 112 shed.dual-low.s-part-0032.t-0009.t-msedge.net 2->112 114 3 other IPs or domains 2->114 116 Multi AV Scanner detection for submitted file 2->116 118 Machine Learning detection for sample 2->118 120 AI detected suspicious sample 2->120 12 Ff0ZjqSI9Y.exe 26 2->12         started        15 Ff0ZjqSI9Y.exe 26 2->15         started        signatures3 process4 file5 90 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 12->90 dropped 92 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 12->92 dropped 94 C:\Users\user\AppData\Local\...\python310.dll, PE32+ 12->94 dropped 102 16 other files (none is malicious) 12->102 dropped 17 Ff0ZjqSI9Y.exe 2 12->17         started        96 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 15->96 dropped 98 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 15->98 dropped 100 C:\Users\user\AppData\Local\...\python310.dll, PE32+ 15->100 dropped 104 16 other files (none is malicious) 15->104 dropped 21 Ff0ZjqSI9Y.exe 15->21         started        process6 dnsIp7 106 api.ipify.org 104.26.12.205, 443, 49852, 49909 CLOUDFLARENETUS United States 17->106 108 discord.com 162.159.137.232, 443, 49858, 49911 CLOUDFLARENETUS United States 17->108 72 C:\Users\user\AppData\...\Ff0ZjqSI9Y.exe, PE32+ 17->72 dropped 23 cmd.exe 1 17->23         started        25 Ff0ZjqSI9Y.exe 26 17->25         started        28 cmd.exe 1 17->28         started        30 cmd.exe 17->30         started        32 cmd.exe 21->32         started        34 cmd.exe 21->34         started        file8 process9 file10 36 Ff0ZjqSI9Y.exe 26 23->36         started        40 taskkill.exe 1 23->40         started        42 conhost.exe 23->42         started        82 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 25->82 dropped 84 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 25->84 dropped 86 C:\Users\user\AppData\Local\...\python310.dll, PE32+ 25->86 dropped 88 16 other files (none is malicious) 25->88 dropped 44 Ff0ZjqSI9Y.exe 25->44         started        46 conhost.exe 28->46         started        48 conhost.exe 30->48         started        50 conhost.exe 32->50         started        52 conhost.exe 34->52         started        process11 file12 74 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 36->74 dropped 76 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 36->76 dropped 78 C:\Users\user\AppData\Local\...\python310.dll, PE32+ 36->78 dropped 80 16 other files (none is malicious) 36->80 dropped 122 Multi AV Scanner detection for dropped file 36->122 124 Potentially malicious time measurement code found 36->124 54 Ff0ZjqSI9Y.exe 1 36->54         started        56 cmd.exe 1 44->56         started        58 cmd.exe 1 44->58         started        signatures13 process14 process15 60 cmd.exe 54->60         started        62 cmd.exe 54->62         started        64 conhost.exe 56->64         started        66 conhost.exe 58->66         started        process16 68 conhost.exe 60->68         started        70 conhost.exe 62->70         started       
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/add2ade24a91060f68861cf95604a7e1910849b67b255e5caec98e57919b1b2c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/add2ade24a91060f68861cf95604a7e1910849b67b255e5caec98e57919b1b2c/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-10-18 10:42:02 UTC
File Type:
PE+ (Exe)
Extracted files:
732
AV detection:
14 of 24 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vxjk3yskseda62egdt4vmbfh4giqqsnwpmsv4xfozghfpem3dmwa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence pyinstaller
Link:
https://tria.ge/reports/241019-fnjnrs1bpq/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Detects Pyinstaller
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ac884c15-30cd-4249-b7de-052eb55fc68c
Unpacked files
SH256 hash:
337de6dbe4474aa48cab9a3dbc6e41094a8babe53225a9a53d86febd68c7b329
MD5 hash:
99603c38f24707c808af4d94be410555
SHA1 hash:
9777916543f19cd753878e67eaf360733d1744e7
Link:
https://www.unpac.me/results/092ba554-f714-4997-aa0c-f4900d0e35e4/
SH256 hash:
add2ade24a91060f68861cf95604a7e1910849b67b255e5caec98e57919b1b2c
MD5 hash:
f9a10faa0b2159b8f2e99f013be6c24b
SHA1 hash:
6811c0c3eb6dcee7842f2ed1dc834c478de90ba7
Link:
https://www.unpac.me/results/092ba554-f714-4997-aa0c-f4900d0e35e4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/add2ade24a91060f68861cf95604a7e1910849b67b255e5caec98e57919b1b2c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:CHM_File_Executes_JS_Via_PowerShell
Create hunting rule
Author:daniyyell
Description:Detects a Microsoft Compiled HTML Help (CHM) file that executes embedded JavaScript to launch a messagebox via PowerShell
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:Rooter
Create hunting rule
Author:Seth Hardy
Description:Rooter
Rule name:RooterStrings
Create hunting rule
Author:Seth Hardy
Description:Rooter Identifying Strings
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe add2ade24a91060f68861cf95604a7e1910849b67b255e5caec98e57919b1b2c

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3240624/
  
URLhaus
https://urlhaus.abuse.ch/url/3242315/
  
URLhaus
https://urlhaus.abuse.ch/url/3242369/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (FORCE_INTEGRITY)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::ConvertSidToStringSidW
ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::GetTokenInformation
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineW
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::RemoveDirectoryW
KERNEL32.dll::SetDllDirectoryW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::CreateWindowExW

Comments


Avatar
zbet commented on 2024-10-19 05:00:34 UTC

url : hxxp://194.5.152.215/sitef/btc/svchost.exe