MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af67a6bd0baf78191617c97aad2d21b7d6133e879c92c97b1b1345d629f79661. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	af67a6bd0baf78191617c97aad2d21b7d6133e879c92c97b1b1345d629f79661
SHA3-384 hash:	b16ce4ac211d93589ad72dffdc5223caf225071bf03afc574f7ea7806bfb941923a282b5d0a0310791f3c7159159533e
SHA1 hash:	3bc5de15b605a222862afffa7c65fe6def254181
MD5 hash:	6c7f6d2ac093abd0edcd16e29de79dd5
humanhash:	black-one-saturn-potato
File name:	Noteppad_SettupX32iX64-carved.exe
Download:	download sample
File size:	333'344 bytes
First seen:	2023-01-03 16:30:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ede8909d0925c770667cae9cf3798673
ssdeep	6144:tAAobu/K6eKHkRYZ9kSqp29ZGbpYByPT7lyvIcySIvF68fx:+AoUK6fHkQWB29vByPHly5VIvk8J
Threatray	16'284 similar samples on MalwareBazaar
TLSH	T11564CFC4D2D359F5DC2319B0462BFBBF95302B424C31CEB6EB483686BE336626454B99
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	a2a9d8f88a88c9c0 (11 x SnakeKeylogger, 4 x RedLineStealer, 4 x AgentTesla)
Reporter	malware_traffic
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

182

Origin country :

US

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Noteppad_SettupX32iX64-carved.exe

Verdict:

Malicious activity

Analysis date:

2023-01-03 16:32:28 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/76b2f0fe-551f-4b58-8876-c34e09c4862f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP GET request

Creating a file in the %AppData% directory

Launching a process

Deleting a recently created file

Reading critical registry keys

Searching for the window

Launching the default Windows debugger (dwwin.exe)

Forced system process termination

Stealing user critical data

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  2/10

Confidence:

100%

Tags:

anti-debug overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/63b45847bf1064ac5b2d87f9/reports/a5f34013-be50-4a01-b03b-171917411709/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/318364a6-f43d-46cb-883c-02011981661d

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1144659

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/af67a6bd0baf78191617c97aad2d21b7d6133e879c92c97b1b1345d629f79661/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-01-03 16:31:06 UTC

File Type:

PE (Exe)

Extracted files:

10

AV detection:

12 of 26 (46.15%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v5t2npilv54bsfqxzf5k2ljbw7lbgpuhtsjms6y3cnc5mkpxszqq._file

Threatray unknown

Verdict:

unknown

Similar samples:

1a26f913157ad417326e84278e34076d240621da8f5cf3c82b3debd31c988101

2f5adcd21b56b7a72adadb73a7d29ea9158a1b10cf02be624f60f41a3b1fce0d

590420a09891c0a91ecdc29942328e707cc3f0243f5c9907c96150eb15fe1052

9f29109994932960f368925877a9beed7cd6e687686cc8131937e7bbe58384f4

a256f95be0153ffd0deb5830f2108794321757ed0a44166147f7e3e646889979

c0178dc0e1f125da7b6bab419edc783fdff63a376019140e086e6bc10ec588bd

d719df850d62a455d34bf2a5847b36e6d267047824b2e96b7c4c9cdfbd9737e3

dabdfc50cc2a6bc20b098b7feee83bedf463d58e0a9f824831290acefddc703c

ef2dd208f149f8ae0741c2cf4fa5270e8d54c35e161f88aad9b109c679e211a2

fc0cb0682ccc37bdd72fab5106d45ebf7fb014b15004d65d627f6e2aed0750b4

+ 16'274 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection discovery spyware stealer

Link:

https://tria.ge/reports/230103-t1c9eafc2t/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

Accesses Microsoft Outlook profiles

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

UnpacMe

Unpacked files

SH256 hash:

af67a6bd0baf78191617c97aad2d21b7d6133e879c92c97b1b1345d629f79661

MD5 hash:

6c7f6d2ac093abd0edcd16e29de79dd5

SHA1 hash:

3bc5de15b605a222862afffa7c65fe6def254181

Link:

https://www.unpac.me/results/9d3b568b-cc64-4cdf-a0f1-283c9864c492/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/af67a6bd0baf78191617c97aad2d21b7d6133e879c92c97b1b1345d629f79661