MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3325327f0ae9d4c4feef6a4fa9f7a488f63cf073d8b3c18d574c02eb06bc8f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3325327f0ae9d4c4feef6a4fa9f7a488f63cf073d8b3c18d574c02eb06bc8f4
SHA3-384 hash: dd13e222d2641d804e7db57b40fa1ab5426eb4ee8bec99f74bf9b937ada78128dd6764180563027ebc0b25632466773c
SHA1 hash: 4648799e7b9399be17b35369f8de1c6bbd34781e
MD5 hash: bfdb1b482f67b6612f75e0261c500cb3
humanhash: lion-one-queen-oscar
File name:bfdb1b482f67b6612f75e0261c500cb3.exe
Download: download sample
File size:579'072 bytes
First seen:2023-08-13 07:53:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:SBnGSxCpVtoTwDfN13x5+xeBKDQtMw8SnF+8nBadPT9r:SBnGSw7fn3x5+xeBKDQtR8m+AcRTF
Threatray 40 similar samples on MalwareBazaar
TLSH T12BC4112C2932C04EE22E7E7FEE6123846DF50EE5442EBACFC245025D475DB7946E6AD0
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
242
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
bfdb1b482f67b6612f75e0261c500cb3.exe
Verdict:
Malicious activity
Analysis date:
2023-08-13 08:01:50 UTC
Tags:
lgoogloader opendir loader smoke trojan stealer redline evasion
Link:
https://app.any.run/tasks/fffbd32a-9591-4f64-ad09-d85373f963ca

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/442472/
Detection(s):
SecuriteInfo.com.Win64.DropperX-gen.14716.30062.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Creating a service
Launching a service
Loading a system driver
Creating a file in the Windows subdirectories
Сreating synchronization primitives
Creating a file in the Windows directory
Creating a process with a hidden window
Launching a process
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Enabling autorun for a service
Blocking the User Account Control
Forced shutdown of a system process
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b3325327f0ae9d4c4feef6a4fa9f7a488f63cf073d8b3c18d574c02eb06bc8f4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1c175ba2-cc47-4529-8617-17953ef1ab9d
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1290629
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Sample uses string decryption to hide its real strings
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3325327f0ae9d4c4feef6a4fa9f7a488f63cf073d8b3c18d574c02eb06bc8f4/
Threat name:
Win64.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-08-11 22:16:51 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
5
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wmzfgj7qv2ouyt7o62spvh32jchwhtyhhwftyggvotac5mdlzd2a._file
Verdict:
malicious
Similar samples:
2e4548a3744c45b01a65b8523d08f044ecf9e1cba90f3e792d3894d5c72dbabe
4412a658ff8b5e5c1048703b9307e62e7565834d1eaa5e0ad8db96ee72f9b162
4cb622e428772576bdcf156ec4030b782f0764fd6ea9da4de543e5723fb62b9d
597545bb4c9d31c409a8d7990e7d9e90e55c06a7c7e16dfa7001bdef62797e43
61c8261eea2ec84dac43c11db5b13579cde940032a0b5ea9a6b1f58b93b1582a
6a3ea5ef986f8bc290a7393c4a890e87b583f5d30d2afa771b3540a54ae0313e
73f2bda2748d084de9a966db5a390504cc5bd65f030492ac50861d2587b49e7f
8678f9a3ecfd06cd0f5f2ecd34414ccfd0dc475b8f7d4269e330b5935a8e8f99
d0d417ece8e94dbb4834e29c345d2e05de5de8ba3b3e05d922614c6f508d4cbe
d5dff38d0773eefad7e6b3fe7005e8ace7c37fc9a6b88eca21f6120d2b860f32
+ 30 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230813-jrjpqabh2v/
Behaviour
Suspicious behavior: LoadsDriver
Unpacked files
SH256 hash:
b3325327f0ae9d4c4feef6a4fa9f7a488f63cf073d8b3c18d574c02eb06bc8f4
MD5 hash:
bfdb1b482f67b6612f75e0261c500cb3
SHA1 hash:
4648799e7b9399be17b35369f8de1c6bbd34781e
Link:
https://www.unpac.me/results/4db65ee9-5adb-4e06-9ec3-1127dc550048/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b3325327f0ae/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/b3325327f0ae9d4c4feef6a4fa9f7a488f63cf073d8b3c18d574c02eb06bc8f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe b3325327f0ae9d4c4feef6a4fa9f7a488f63cf073d8b3c18d574c02eb06bc8f4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2681759/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/442472/

Comments