MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b22ea99c132ab236e3a9bcc4d42b9038badaaa85c14edfee535e21f7d46436a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b22ea99c132ab236e3a9bcc4d42b9038badaaa85c14edfee535e21f7d46436a1
SHA3-384 hash: 00da7133cb8cca920c1cc3b1242697959eb5557a6c0da596bd1794c3c19267e39b5104c81336ec5f3d881b3afbece2c9
SHA1 hash: 2b62a44ab52cef0a87f115909936006d14fb0027
MD5 hash: 2391dbe5f5dc587eab3321869dd43ec5
humanhash: berlin-ink-washington-yankee
File name:2391dbe5f5dc587eab3321869dd43ec5
Download: download sample
File size:1'413'632 bytes
First seen:2021-10-24 07:44:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a760781485268ad462242975d68411d5
ssdeep 24576:X/mj8gr6siw8y8KbE0N4TMAeulQI1N6y83bMJb2dtGulJe:XOjH7iby84E0aTrlQcNkbYidv
Threatray 82 similar samples on MalwareBazaar
TLSH T16C657D4AA3A901E8D0ABD278CA52950BE7B17C0103709BDF17D95B5A1F23FE05E7E721
Reporter zbetcheckin
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
496
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/199633/
Detection(s):
Win.Malware.Spyagent-9830839-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/61751226db358dd15ed922d1/reports/314b7129-8f4d-4490-92f7-d316c28d2edb/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a427b576-8fdc-4f72-8662-b3b58fab9a06
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/875771
Signature
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b22ea99c132ab236e3a9bcc4d42b9038badaaa85c14edfee535e21f7d46436a1/
Threat name:
Win64.Trojan.Fabookie
Create hunting rule
Status:
Malicious
First seen:
2021-10-24 07:45:08 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2
42de2be8dd54f0733138e13af44653c7acf129ab0acc376d89a18b2b8a69101e
4cd754af5d3b9faa7e9626f79fccc35464224247a10f4d01ef502a0423e637a7
55944c6ffe4959032363fb52da47741b8e6464cf05b7718462112ddd9d506f5e
8f8042ea48aa01dd010aede41cbfe28ba2741a9c0bc7b5c7b55d38e1ab3b5027
c03c8a4852301c1c54ed27ef130d0de4cdfb98584adef3dda2a096177016a18b
ccfd37710068b3998537ac325e29555ba9375ebf1230cf90e9dcf133e06bcdf3
d7b0380241e4d47fc00e72faa08831b51b0ae360d5ccc45717f39f3106c3020a
eae36eba857fac64d7b10f7055df67010c65bdf968734007462a9d6e2bdae47c
fd4d1fc83330c5cf818e557ef882ca147ba98fee4128fe00bda07c6c2f79050a
+ 72 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/211024-jld72sddh3/
Behaviour
Looks up external IP address via web service
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
b22ea99c132ab236e3a9bcc4d42b9038badaaa85c14edfee535e21f7d46436a1
MD5 hash:
2391dbe5f5dc587eab3321869dd43ec5
SHA1 hash:
2b62a44ab52cef0a87f115909936006d14fb0027
Link:
https://www.unpac.me/results/65c2b1e6-d932-4bda-9da1-3fbfd139b23a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b22ea99c132ab236e3a9bcc4d42b9038badaaa85c14edfee535e21f7d46436a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe b22ea99c132ab236e3a9bcc4d42b9038badaaa85c14edfee535e21f7d46436a1

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/199633/

Comments


Avatar
zbet commented on 2021-10-24 07:44:58 UTC

url : hxxp://file.ekkggr3.com/lqosko/p18j/customer1.exe