MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aee541b0f2bfc27b28e779c7ddbe8a251867157844a5581295e3d9018a30a678. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aee541b0f2bfc27b28e779c7ddbe8a251867157844a5581295e3d9018a30a678
SHA3-384 hash: c6d8b007c668e44463f74700aa000d0318e926b28aa3513e30e8b0d6a158b27700a4c533717b24fe61cca5d095cd5e1a
SHA1 hash: 3e69a6428921966fe6709156f3b2ce34638ee62a
MD5 hash: e99fa8dfd754d396d7a55cd287827f51
humanhash: foxtrot-rugby-river-skylark
File name:e99fa8dfd754d396d7a55cd287827f51.exe
Download: download sample
File size:1'108'526 bytes
First seen:2021-06-15 06:27:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 011a034751880c1944da3b5ecc18520d (8 x RedLineStealer, 4 x CryptBot, 3 x ArkeiStealer)
ssdeep 24576:q9btxEOV0ZHeOq2F7Sygl3i8A9hCeaN5DmQagb+ak8MQWa1TunrrWHl2f:qNNjm4l3i8JNN5Dmi6B8MQDmrWof
Threatray 249 similar samples on MalwareBazaar
TLSH A335F0CD6B8CB2B6C5DD39F0447027630965AF2D1FE2CD87768CFB06DE6E181A528285
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e99fa8dfd754d396d7a55cd287827f51.exe
Verdict:
Malicious activity
Analysis date:
2021-06-15 06:32:26 UTC
Tags:
trojan 1xxbot
Link:
https://app.any.run/tasks/6f16fc34-8f14-4779-80f7-bf9a4e4b6ef2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/166380/
Detection(s):
PUA.Win.Downloader.Driverpack-6998194-0
Create hunting rule

PUA.Win.Adware.Generic-7505646-0
Create hunting rule

PUA.Win.File.Generic-7557964-0
Create hunting rule

SecuriteInfo.com.Backdoor.Agent.Win32.80093.30955.12989.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Launching a process
Creating a process from a recently created file
DNS request
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Sending a UDP request
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/504dbeeb-8e96-4b75-be91-c2f3c468e6ea
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/802149
Signature
Contains functionality to register a low level keyboard hook
Creates processes via WMI
Drops PE files with a suspicious file extension
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Obfuscated command line found
Sigma detected: Drops script at startup location
Submitted sample is a known malware sample
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 434544 Sample: rZAB2uA9l8.exe Startdate: 15/06/2021 Architecture: WINDOWS Score: 84 45 prda.aadg.msidentity.com 2->45 47 clientconfig.passport.net 2->47 65 Multi AV Scanner detection for submitted file 2->65 67 Sigma detected: Drops script at startup location 2->67 69 Machine Learning detection for sample 2->69 10 rZAB2uA9l8.exe 7 2->10         started        13 wscript.exe 2->13         started        15 rHmhcACVfb.exe.com 2->15         started        signatures3 process4 dnsIp5 75 Contains functionality to register a low level keyboard hook 10->75 18 cmd.exe 1 10->18         started        77 Creates processes via WMI 13->77 55 WAWiTjamcpRJLCcjfPfq.WAWiTjamcpRJLCcjfPfq 15->55 signatures6 process7 signatures8 57 Submitted sample is a known malware sample 18->57 59 Obfuscated command line found 18->59 61 Uses ping.exe to sleep 18->61 63 Uses ping.exe to check the status of other devices and networks 18->63 21 cmd.exe 3 18->21         started        24 conhost.exe 18->24         started        process9 signatures10 71 Obfuscated command line found 21->71 73 Uses ping.exe to sleep 21->73 26 Pausa.exe.com 21->26         started        29 PING.EXE 1 21->29         started        32 findstr.exe 1 21->32         started        process11 dnsIp12 79 Drops PE files with a suspicious file extension 26->79 35 Pausa.exe.com 6 26->35         started        51 127.0.0.1 unknown unknown 29->51 53 192.168.2.1 unknown unknown 29->53 39 C:\Users\user\AppData\Local\...\Pausa.exe.com, Targa 32->39 dropped file13 signatures14 process15 dnsIp16 49 WAWiTjamcpRJLCcjfPfq.WAWiTjamcpRJLCcjfPfq 35->49 41 C:\Users\user\AppData\...\rHmhcACVfb.exe.com, PE32 35->41 dropped 43 C:\Users\user\AppData\...\rHmhcACVfb.url, MS 35->43 dropped file17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aee541b0f2bfc27b28e779c7ddbe8a251867157844a5581295e3d9018a30a678/
Threat name:
Win32.Trojan.Crypzip
Create hunting rule
Status:
Malicious
First seen:
2021-06-14 23:45:14 UTC
AV detection:
9 of 29 (31.03%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
03110bdd6c0d0f027422de86d47ce39cfb8cae70c04a616cbb8c325c03853ef6
03c770bfc70f92e979e48b46b0604c3254796123e48af7d611017af862321bea
47b989b710739b1c88408ca9bf1b4e833cdab68b4c205c5bcbd94bec501c9b80
9d03f0739a3840f5461af1d6ffa96a34c8a0df1b428b58825d95fe3a43a55d92
9f6eb963b28951006fa6254b74f58b087c4469496c8ab22cf74210510f82c186
a8f08798d07631c972e1d31bd0c696859d060fdce618eb3fc0c214b94038767b
acc09a3633289ac4c40c744409c20f5f5167cf55fc792371d0e4bd9331c2ce31
d3a7838ae798a5d0271bd35063602eddab284157f1963d1b71812542ba6f92c4
e31da697e1f30aca20cb88b09a69ed60bdbba9b3c4da0e67e2654ecb541964f2
f4a40d6bf3a266e83bbeb76bd3c865b8c3e925a16f890d107356c62563de3f33
+ 239 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210615-cr42kw524n/
Behaviour
Runs ping.exe
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Drops startup file
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
d0c2208cac9cf894507b4d442c821dc2d85fd7fbb0d0ff5bc181cec4b3bfc6b9
MD5 hash:
7d0827371ad8d2a3c017fdd9b380edd3
SHA1 hash:
c2c1f423b6d22dc91b69e2261bd447e7f9f18640
Link:
https://www.unpac.me/results/70a2e88f-940e-439f-a503-2fae25557782/
Parent samples :
c9e1de1c6ddd3ffd9c87ebdbcf9bd5b7064af9f60f650ae50573b05a49af8327
1e71bcb4133949eaa1bead27b4e01f03f7802c6b92f61acbb6b8d7c8faf419d7
3ecf5237981fc6575586fe2e13f9afe240b132b58d7bc071296ec3816b150d26
bbfda112b2d2742ec593b14cf9a0d2558cedaa24ae89d0cc9b5c94b94705c772
feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36
f8387262e71195a4db4a0ca0fe68b973e225b8dfe7b475580d19240a760d1e73
fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693
5e30143f53af82ff891d9801ccff6b30e3dc7f3401bba597accb26e2d3b8b25d
fa5995b67f40f6c2cf7f3edba1e5a2213f2b083a35b13503af7a6203b4b8c33a
a6b218813c937087c078983f17d2520b0c2e7ad5d0cc41bfdf1d0cb540e4470a
440a157bbd8c8332d4edc63e6dc1399777e73bfb7ef3c5a356ab98fa56d1feea
95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874
007c6dfe4466894d678c06e6b30df77225450225ddd8e904e731cab32e82c512
9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba
c71463ac4fb8dd985b249b61e54888137bea84dab7c202546e230eb450fc0969
34b896d2e6470b2bd8facb9a796e0a521b78ec4956a573b5b38cacdc42622caa
8b738c9057baa2c3219120919226e95659cccec0dc61aca579bba58c7090719e
f6b2cd5327818418db45f70ed99bc6751d836eaf503a9bf33602af0c74f61e83
b426a6cb4005e266bf9b91b30d46fbbd0d6c541ac40d295aa99b8b7ef45e0edf
d43af0c0a5058412c903698b4ac55f150f6a20cac43344b5a596906780dac1f7
b4ca0b94b1a4e5b2ed28ad66c2df781b5add3c46cf5232b64b3a5253bcc341e8
1d40c76cecaabdf1e1d0004aa15cb469aa4374d1d0b2e48a47e588b1f84113d6
afdb413119fa2e0755a4885146d44547b97096d700d2b1236c6aba8f9bb9719d
7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91
d11d8d13e611c17ae61db286984170b2eb6802d2c23630e3211b9cfddaef09e6
d1dae6a275073c722606d35b783b4d176c0d8e0feff6c903c27ab9f0f8d7ab07
7c86e8c4143be0e27af9558ca46b3b4d7c5bee5e58e18902757bc02f6a3863a2
28319673d8f382142e223302ede1e0e497ccac2cd7a9814715726335e78c29c7
b130fe2fceada2a1980b6a0015c1bc1a9c1ee08f6229d99e43de82351da541fa
48a4042854a402824d35f4c95aed1e448d652d79ed0c251635acbc073200dfcf
e1f193deaa71595b668320d294635988f66c0f1ab1ab218e08fe3ae87fe10838
90f608b784fc8eac0a899d6aec257ec4beaf836e0cc808c7496f131aba61bef0
8435702911a3d6ebac7acef5aff7bc30395427892c1ddf39647b912a93260258
5bbb7a91ebfa925b0765103006bdde91f19c648ae792fab9dbc73832f3b2423c
SH256 hash:
aee541b0f2bfc27b28e779c7ddbe8a251867157844a5581295e3d9018a30a678
MD5 hash:
e99fa8dfd754d396d7a55cd287827f51
SHA1 hash:
3e69a6428921966fe6709156f3b2ce34638ee62a
Link:
https://www.unpac.me/results/70a2e88f-940e-439f-a503-2fae25557782/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aee541b0f2bfc27b28e779c7ddbe8a251867157844a5581295e3d9018a30a678

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe aee541b0f2bfc27b28e779c7ddbe8a251867157844a5581295e3d9018a30a678

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1104214/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/166380/

Comments