MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 afb0b4b9568b9cba1eb93d3a60a6e459ef983c2e39f64f39de2fd7ad3e107177. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stop


Vendor detections: 19


Intelligence 19 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: afb0b4b9568b9cba1eb93d3a60a6e459ef983c2e39f64f39de2fd7ad3e107177
SHA3-384 hash: a977bfe2d01a5b3c72f20352964404e247183cfe17315592e8d4e3741701edbfc52d0c69ee15c9d48c80b003bf5e78f1
SHA1 hash: e87fd365807cd0dd15b70063beadfc20a988d06c
MD5 hash: 48bba0776399b84f275e7478cd60edfd
humanhash: utah-tennessee-tennis-oklahoma
File name:buildz.exe
Download: download sample
Signature Stop
Create hunting rule
File size:759'808 bytes
First seen:2023-12-21 05:16:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9138bad961b0c12306fd188b3eb186f0 (1 x LummaStealer, 1 x Stop, 1 x Stealc)
ssdeep 12288:UKkwWoPlLr52zrZxRJY8X7VCTxJ3Dfn8g8gSaLK6+RI5bPhx+SBjl98o5WXjJ:LLr0z7HhITTDf8kSau6U4+SB/t5WX
Threatray 2'204 similar samples on MalwareBazaar
TLSH T194F4E02382E17D95FA22CB729E1E8AE8779EF2408F597BEB22585B1B04711F1C573701
TrID 34.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
25.1% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
18.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
6.3% (.EXE) Win64 Executable (generic) (10523/12/4)
3.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon 0202010418082000 (1 x Stop)
Reporter adm1n_usa32
Tags:exe Stop

Intelligence

File Origin
# of uploads :
1
# of downloads :
323
Origin country :
RO RO
Vendor Threat Intelligence
Malware family:
stop
Create hunting rule
ID:
1
File name:
buildz.exe
Verdict:
Malicious activity
Analysis date:
2023-12-21 05:19:46 UTC
Tags:
ransomware stop loader vodkagats stealer vidar raccoonclipper
Link:
https://app.any.run/tasks/8d4a3174-f581-4e75-9958-1b0bfef91ebc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
STOP
Create hunting rule
Link:
https://www.capesandbox.com/analysis/468731/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Sending an HTTP GET request
Creating a file
Launching a process
Creating a process with a hidden window
Adding an access-denied ACE
Sending a custom TCP request
Сreating synchronization primitives
Deleting a recently created file
Searching for synchronization primitives
Query of malicious DNS domain
Sending a TCP request to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6583ca4fb855eb3693ea55a8/reports/1752c82f-6209-463f-9bff-c4a46109920e/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/afb0b4b9568b9cba1eb93d3a60a6e459ef983c2e39f64f39de2fd7ad3e107177
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
STOP Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7cb64f79-c203-49bf-b04c-f67a6eaf340d
Result
Threat name:
Babuk, Clipboard Hijacker, Djvu, Vidar
Create hunting rule
Detection:
malicious
Classification:
rans.spre.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1365426
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found ransom note / readme
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes a notice file (html or txt) to demand a ransom
Writes many files with high entropy
Yara detected AntiVM3
Yara detected Babuk Ransomware
Yara detected Clipboard Hijacker
Yara detected Djvu Ransomware
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1365426 Sample: buildz.exe Startdate: 21/12/2023 Architecture: WINDOWS Score: 100 95 zexeq.com 2->95 97 brusuax.com 2->97 99 2 other IPs or domains 2->99 115 Snort IDS alert for network traffic 2->115 117 Found malware configuration 2->117 119 Malicious sample detected (through community Yara rule) 2->119 121 12 other signatures 2->121 11 buildz.exe 2->11         started        14 buildz.exe 2->14         started        16 mstsca.exe 2->16         started        18 5 other processes 2->18 signatures3 process4 signatures5 137 Detected unpacking (changes PE section rights) 11->137 139 Detected unpacking (overwrites its own PE header) 11->139 141 Writes a notice file (html or txt) to demand a ransom 11->141 151 2 other signatures 11->151 20 buildz.exe 1 17 11->20         started        24 build3.exe 11->24         started        143 Antivirus detection for dropped file 14->143 145 Multi AV Scanner detection for dropped file 14->145 147 Machine Learning detection for dropped file 14->147 26 buildz.exe 19 14->26         started        149 Injects a PE file into a foreign processes 16->149 29 mstsca.exe 16->29         started        31 buildz.exe 18->31         started        33 buildz.exe 18->33         started        35 mstsca.exe 18->35         started        37 2 other processes 18->37 process6 dnsIp7 101 api.2ip.ua 172.67.139.220, 443, 49704, 49705 CLOUDFLARENETUS United States 20->101 75 C:\Users\user\AppData\Local\...\buildz.exe, PE32 20->75 dropped 39 buildz.exe 20->39         started        42 icacls.exe 20->42         started        77 C:\Users\user\AppData\Roaming\...\mstsca.exe, PE32 24->77 dropped 44 schtasks.exe 24->44         started        79 C:\Users\user\_readme.txt, ASCII 26->79 dropped 81 C:\Users\user\Desktop\...\TQDFJHPUIU.png, data 26->81 dropped 83 C:\Users\user\DesktopbehaviorgraphRXZDKKVDB.png, data 26->83 dropped 85 C:\Users\user\AppData\Local\...\_readme.txt, ASCII 26->85 dropped 135 Modifies existing user documents (likely ransomware behavior) 26->135 46 schtasks.exe 29->46         started        file8 signatures9 process10 signatures11 123 Injects a PE file into a foreign processes 39->123 48 buildz.exe 1 23 39->48         started        53 conhost.exe 44->53         started        55 conhost.exe 46->55         started        process12 dnsIp13 91 zexeq.com 201.119.56.230, 49707, 49708, 49710 UninetSAdeCVMX Mexico 48->91 93 brusuax.com 211.53.230.67, 49709, 80 LGDACOMLGDACOMCorporationKR Korea Republic of 48->93 67 C:\Users\user\AppData\Local\...\build3[1].exe, PE32 48->67 dropped 69 C:\_readme.txt, ASCII 48->69 dropped 71 C:\Users\user\...\acroNGLLog.txt.loqw (copy), data 48->71 dropped 73 120 other malicious files 48->73 dropped 111 Infects executable files (exe, dll, sys, html) 48->111 113 Modifies existing user documents (likely ransomware behavior) 48->113 57 build2.exe 48->57         started        60 build3.exe 48->60         started        file14 signatures15 process16 signatures17 125 Detected unpacking (changes PE section rights) 57->125 127 Detected unpacking (overwrites its own PE header) 57->127 129 Writes many files with high entropy 57->129 62 build2.exe 57->62         started        131 Uses schtasks.exe or at.exe to add and modify task schedules 60->131 133 Injects a PE file into a foreign processes 60->133 process18 dnsIp19 103 t.me 149.154.167.99, 443, 49712 TELEGRAMRU United Kingdom 62->103 105 116.203.164.22, 3000, 49713, 49715 HETZNER-ASDE Germany 62->105 87 C:\Users\user\AppData\...\sqlite3[1].dll, PE32 62->87 dropped 89 C:\Users\...\77EC63BDA74BD0D0E0426DC8F8008506, Microsoft 62->89 dropped 107 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 62->107 109 Tries to harvest and steal browser information (history, passwords, etc) 62->109 file20 signatures21
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/afb0b4b9568b9cba1eb93d3a60a6e459ef983c2e39f64f39de2fd7ad3e107177
Detection:
vidar
Create hunting rule
Link:
https://mwdb.cert.pl/sample/afb0b4b9568b9cba1eb93d3a60a6e459ef983c2e39f64f39de2fd7ad3e107177/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-12-21 05:17:06 UTC
File Type:
PE (Exe)
Extracted files:
41
AV detection:
17 of 23 (73.91%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v6yljokwrooluhvzhu5gbjxelhxzqpbohh3e6oo6f7l22pqqof3q._file
Verdict:
malicious
Similar samples:
2831300675369e6ac5d928446186f83bedc4027fe6db617039e5b224258ed0b6
Stop
35ba91ddf0d41590d0de137bc1d6e5524d8a84ecfabdae793e6b3a499f2c67d4
Stop
6a455892dc6b808ff4f012010f20ad4bbf16b881b9c235d98c85565591289012
Stop
83c4c80adbeb1d8411e49c1d14a886af6a26c9fb9827d8852d4e45e4a5f09b17
Stop
a0038a7651f4408728f4a8c7a2abe43b237fc9dc6645fa34e5c4d9c212658878
Stop
b299675e7e4654beadcaa2c38a96bf8324bbde96904ede17fdd88ebb7fdf2748
Stop
d46fec4abba46efe6663f19c2d9963a612f4ff25023c0dc6fc5bb559f106859d
Stop
+ 2'194 additional samples on MalwareBazaar
Result
Malware family:
djvu
Create hunting rule
Score:
  10/10
Tags:
family:djvu discovery persistence ransomware
Link:
https://tria.ge/reports/231221-fypmrsfggn/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Downloads MZ/PE file
Detected Djvu ransomware
Djvu Ransomware
Malware Config
C2 Extraction:
http://zexeq.com/test1/get.php
Unpacked files
SH256 hash:
c9544e1c5e991c77aac8b59c9a6e3ced871c006edeaf10e602c42909345b8dfe
MD5 hash:
98121e23d8511b5f75f806c0893be616
SHA1 hash:
dd4532ac1e112963b50ff24ab0933e15585565da
Detections:
djvu_ransomware
Create hunting rule
win_stop_auto
Create hunting rule
SUSP_XORed_URL_In_EXE
Create hunting rule
MALWARE_Win_STOP
Create hunting rule
Link:
https://www.unpac.me/results/7e62da60-910c-4102-91ad-1972a23dd954/
SH256 hash:
afb0b4b9568b9cba1eb93d3a60a6e459ef983c2e39f64f39de2fd7ad3e107177
MD5 hash:
48bba0776399b84f275e7478cd60edfd
SHA1 hash:
e87fd365807cd0dd15b70063beadfc20a988d06c
Link:
https://www.unpac.me/results/7e62da60-910c-4102-91ad-1972a23dd954/
Malware family:
Djvu
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/afb0b4b9568b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/afb0b4b9568b9cba1eb93d3a60a6e459ef983c2e39f64f39de2fd7ad3e107177

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stop

Executable exe afb0b4b9568b9cba1eb93d3a60a6e459ef983c2e39f64f39de2fd7ad3e107177

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2742270/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/468731/

Comments