MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0e2ee5d5dcf0c508bd3f0d3016bc483d880ae94120fe214a4bff996bcc074aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0e2ee5d5dcf0c508bd3f0d3016bc483d880ae94120fe214a4bff996bcc074aa
SHA3-384 hash: ddca464300e9b8988abab5a2c4f7a5a8d1c33f75704758978eeb1a2fdb59c4d15174c98bc758c790a5c0a303714d8ff4
SHA1 hash: badd878d8558f062e975321cf93ead7fd1849b45
MD5 hash: ece726225d70c026d73187245e8235e3
humanhash: dakota-green-michigan-summer
File name:file
Download: download sample
File size:504'320 bytes
First seen:2022-12-02 13:01:53 UTC
Last seen:2022-12-02 15:07:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:Yv+nY5r36/J2AGn+H82XoaQjtHhqO24ZZC2CIcD+LcH:Yv+Y5r36/QAGn+c2Xsh9yIcSLu
Threatray 728 similar samples on MalwareBazaar
TLSH T163B423732D8793F0F1AB4D7E4CAF83256738E86A10C5E2DF4544E8A13463A658F2BD84
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter andretavare5
Tags:exe


Avatar
andretavare5
Sample downloaded from https://myexes.s3.ap-northeast-1.amazonaws.com/Adsme.exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
185
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
No threats detected
Analysis date:
2022-12-02 13:02:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/548be04f-7710-4843-9428-66ab1f760310

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/341897/
Detection(s):
SecuriteInfo.com.Variant.Cerbu.158494.24375.21375.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a service
Loading a system driver
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Changing a file
Using the Windows Management Instrumentation requests
Creating a file
Enabling autorun for a service
Blocking the User Account Control
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6389f74d75655a0108ea4bbf/reports/a95849b0-ff95-4df7-8574-4f7c9e424d58/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4ad3b1c8-88ad-4914-8dc2-20b279c8f9d9
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1126505
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Disables UAC (registry)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 759229 Sample: file.exe Startdate: 02/12/2022 Architecture: WINDOWS Score: 68 25 Multi AV Scanner detection for submitted file 2->25 27 .NET source code contains very large array initializations 2->27 29 Machine Learning detection for sample 2->29 7 file.exe 5 5 2->7         started        process3 file4 21 C:\Users\user\AppData\Local\Temp\?????.sys, PE32+ 7->21 dropped 23 C:\Users\user\AppData\Local\...\file.exe.log, CSV 7->23 dropped 31 Adds a directory exclusion to Windows Defender 7->31 33 Disables UAC (registry) 7->33 35 Sample is not signed and drops a device driver 7->35 11 powershell.exe 17 7->11         started        13 RegAsm.exe 7->13         started        15 RegAsm.exe 7->15         started        17 3 other processes 7->17 signatures5 process6 process7 19 conhost.exe 11->19         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b0e2ee5d5dcf0c508bd3f0d3016bc483d880ae94120fe214a4bff996bcc074aa/
Threat name:
ByteCode-MSIL.Trojan.Cerbu
Create hunting rule
Status:
Malicious
First seen:
2022-12-02 13:02:10 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
1
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wdro4xk5z4gfbc6t6djqc26eqpmibluucih6effex74znpgaosva._file
Verdict:
malicious
Similar samples:
24934cfda7f567024000d0992958608ecfcd576e72f9b2f497676f9cf87d8802
53a2a156f71274fb0d724533c57fca357e4d16a8dea55395e58a9f0f00b3e82a
5421c7a5779bbe54def617655c485fb96a9c45e8bad49411f5053a103ade3ad5
58fd04fe003160c5aca2e839d8588bd86b9a2b3ddcd8e3ddd5616182e9d9c45f
852f5fdc41f6a946823e438d3c705407ab50bb35f4496c62fe42b87d10ddda49
868c3436d8926091378d99a17eabdf20f18e58e7e48c1911ba93059f14df01c3
987e3355071cc5ff9241c9cf378655bddbeba89ac3a5377f042e2a2fe14962e0
bc4e6b5f7f8d7765fb865b1dda3803c9a6d53e45777ffdacc5e50b3c7f9b8d9a
e47e898923208e15cedda56de05b9896e2e3df46628a74692d91484ab4fcefcd
f161040af3fb9580715153cf18fab2993f4d16a71ddc99cf14c641772dfbf0ac
+ 718 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan
Link:
https://tria.ge/reports/221202-p9twasac92/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Program crash
Checks whether UAC is enabled
Checks computer location settings
Windows security modification
Sets service image path in registry
UAC bypass
Windows security bypass
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7ecd329a-270a-4768-82f3-fadce7495615
Unpacked files
SH256 hash:
b0e2ee5d5dcf0c508bd3f0d3016bc483d880ae94120fe214a4bff996bcc074aa
MD5 hash:
ece726225d70c026d73187245e8235e3
SHA1 hash:
badd878d8558f062e975321cf93ead7fd1849b45
Link:
https://www.unpac.me/results/43b12da7-1dc8-4af8-b3a5-8b4e5b0a7cd0/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b0e2ee5d5dcf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/b0e2ee5d5dcf0c508bd3f0d3016bc483d880ae94120fe214a4bff996bcc074aa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/341897/

Comments