MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae8b777d1cb934b3f9badd12d3599c739aa7b8972f99b48a5ba668866e34fff4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Adware.Techsnab

Vendor detections: 10

Intelligence 10 IOCs YARA 5 File information Comments 1

SHA256 hash:	ae8b777d1cb934b3f9badd12d3599c739aa7b8972f99b48a5ba668866e34fff4
SHA3-384 hash:	2e674b32df8c0b81dbd72f80a068f67b3100b77198dbace50eb0927fabc9a732251647b77dd417dfe430c336e5f2efca
SHA1 hash:	4f75dc7c374a15026bc3e557d5849d8f27414971
MD5 hash:	95c9c83e4d5f20a4bd8a5354cec20d27
humanhash:	august-utah-nevada-fanta
File name:	95c9c83e4d5f20a4bd8a5354cec20d27
Download:	download sample
Signature	Adware.Techsnab Create hunting rule
File size:	5'592'064 bytes
First seen:	2022-08-10 12:03:49 UTC
Last seen:	2022-08-11 02:31:11 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	83925fa3f4a934ff9c738b0db4549d5a (2 x Adware.Techsnab)
ssdeep	49152:AzROAAIH7gXvVKhB50B/NSzwXKERVxdgtJhYk0bMrNChtmIP8CPZ+XTv4YuBqDvq:AUV+g1+hYnyPhbyaz4v+
TLSH	T1C2468C03F69645EAC0BEC178C6575333E772BC890621B3AB57D49B612E23BA05F2D349
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter	zbetcheckin
Tags:	Adware.Techsnab exe

Intelligence

File Origin

# of uploads :

# of downloads :

380

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

95c9c83e4d5f20a4bd8a5354cec20d27

Verdict:

No threats detected

Analysis date:

2022-08-10 12:07:14 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/4bbb1424-a0e8-4505-b30b-61fde2b4b8b3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/297610/

Detection(s):

SecuriteInfo.com.Trojan.GenericKDZ.90259.21886.997.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Launching the default Windows debugger (dwwin.exe)

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/28524/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm greyware

Link:

https://www.filescan.io/uploads/62f39ef8810e2831b7340991/reports/8b33e36d-2e52-4a73-8905-fbb7e2207334/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/96475854-b1a8-44df-aeba-59167e7fe856

Result

Threat name:

Luca Stealer

Detection:

malicious

Classification:

troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1049166

Signature

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries temperature or sensor information (via WMI often done to detect virtual machines)

Yara detected Luca Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ae8b777d1cb934b3f9badd12d3599c739aa7b8972f99b48a5ba668866e34fff4/

Threat name:

Win64.Infostealer.Disco

Status:

Malicious

First seen:

2022-08-10 10:44:07 UTC

File Type:

PE+ (Exe)

AV detection:

14 of 26 (53.85%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=v2fxo7i4xe2lh6n23ujngwm4oonkpoexf6m3jcs3uzuim3ru772a._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/220810-n8k2bsbgg6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

ae8b777d1cb934b3f9badd12d3599c739aa7b8972f99b48a5ba668866e34fff4

MD5 hash:

95c9c83e4d5f20a4bd8a5354cec20d27

SHA1 hash:

4f75dc7c374a15026bc3e557d5849d8f27414971

Link:

https://www.unpac.me/results/c29a0c93-bed7-45f5-af18-491e4a91153f/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ae8b777d1cb9/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ae8b777d1cb934b3f9badd12d3599c739aa7b8972f99b48a5ba668866e34fff4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	adonunix2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	AD on UNIX

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	INDICATOR_SUSPICIOUS_EXE_DiscordURL Create hunting rule
Author:	ditekSHen
Description:	Detects executables Discord URL observed in first stage droppers

Rule name:	Rustyloader_mem_loose Create hunting rule
Author:	James_inthe_box
Description:	Corroded buerloader
Reference:	https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24