MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3455d9d3bf50da0762a0d2aa57f4041af76b86024376af1a07b774bb7166ffc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3455d9d3bf50da0762a0d2aa57f4041af76b86024376af1a07b774bb7166ffc
SHA3-384 hash: e7a20bdf51690afa3fcc81f372128694d93158ab0420729f0aa5f3fb905ec1d97df767115653d759f162aa7f2b49c284
SHA1 hash: b209592c63aa8decdb7b808b21d384794f5611e4
MD5 hash: 23ffd89c1070ee220bd930e24eb62358
humanhash: golf-nuts-michigan-stream
File name:Internet download manager cracker (1).exe
Download: download sample
File size:6'868'992 bytes
First seen:2020-10-04 00:35:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'855 x AgentTesla, 19'783 x Formbook, 12'304 x SnakeKeylogger)
ssdeep 49152:fQtTig4R9r/5/puFgovx29iDhPFqBbxJj3bhzee+++e76se+iodcG3ey+f2gWlCk:
Threatray 61 similar samples on MalwareBazaar
TLSH FB66CA243DFF501D73B3AE995FD4B8AF9D5EF6732A0A60BA206103468722D81CD91739
Reporter adm1n_usa32
Tags:dropper

Intelligence

File Origin
# of uploads :
1
# of downloads :
450
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/67953/
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Trojan.vz.31973.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file
Sending a UDP request
Creating a window
Creating a file in the %AppData% subdirectories
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/480824
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Binary contains a suspicious time stamp
Creates files with lurking names (e.g. Crack.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3455d9d3bf50da0762a0d2aa57f4041af76b86024376af1a07b774bb7166ffc/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-04 00:36:11 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
066bdbaf5b5526cc3040573bea83da7a384e0c97df13d50a7cc0716b1dd8e6ac
26b7bd2300a9c08d3ef195f92847c8981c0ffcb4a2055002592c8f24c96506ea
2dcabb7757046fa4178695fdfa481b1bb309f0264ee5bc4be4326476e33ec082
5170ff37a0d0a1ba65b92926cc920a9ee99e439ae6ff1dc268e61ab4f58089e1
9631ffcc8769d5ea6582646908a7a7e795cfee8d4fdaa3f1559deefb45ee6934
d959ab3ffc54e02792ddc39c6109e1e72a3e48937c225c06f7692bb4f3ffd888
edd41e1bcb4e8a879d0b2a2126d2484fe63f3831e5400bf2d8133468ce9dd165
f440c2cc4fc3168c939310c4e90b80d980a4a0d6a42f0596d2676461b02d11e2
f6aa394f7b0a0f629da6831a1134e4a6cbf21c70dce7f4133319d638d4b58023
fa377574c99698cd65d8897d93e96c287dff271d4838107aeac36e7a843c1053
+ 51 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201004-lgfnw8xrv2/
Behaviour
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Executes dropped EXE
Unpacked files
SH256 hash:
b3455d9d3bf50da0762a0d2aa57f4041af76b86024376af1a07b774bb7166ffc
MD5 hash:
23ffd89c1070ee220bd930e24eb62358
SHA1 hash:
b209592c63aa8decdb7b808b21d384794f5611e4
Link:
https://www.unpac.me/results/a25a8ee3-d346-4b0b-92f9-98a94bcbcef4/
SH256 hash:
c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26
MD5 hash:
65ef4b23060128743cef937a43b82aa3
SHA1 hash:
cc72536b84384ec8479b9734b947dce885ef5d31
Link:
https://www.unpac.me/results/a25a8ee3-d346-4b0b-92f9-98a94bcbcef4/
SH256 hash:
c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49
MD5 hash:
34ea7f7d66563f724318e322ff08f4db
SHA1 hash:
d0aa8038a92eb43def2fffbbf4114b02636117c5
Link:
https://www.unpac.me/results/a25a8ee3-d346-4b0b-92f9-98a94bcbcef4/
SH256 hash:
3a4d06c3948a2570dc4f9f9f42e090837c6bb114c689b006b09f3b484779788f
MD5 hash:
1c49056dc76c7c073ca62faab254b480
SHA1 hash:
e59c59a79757111ea554e6fe9a49f81340e367b1
Link:
https://www.unpac.me/results/a25a8ee3-d346-4b0b-92f9-98a94bcbcef4/
SH256 hash:
b53257b7ac3b2f1149ca59197134552ee14b2152f7634e3e867532bfa0e7b6ee
MD5 hash:
d74787b06a118ec2bb53d7ef2af51610
SHA1 hash:
015ee818c90bb762dd2b3c39dc399348fdb59f16
Link:
https://www.unpac.me/results/a25a8ee3-d346-4b0b-92f9-98a94bcbcef4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dropper
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/b3455d9d3bf50da0762a0d2aa57f4041af76b86024376af1a07b774bb7166ffc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe b3455d9d3bf50da0762a0d2aa57f4041af76b86024376af1a07b774bb7166ffc

(this sample)

Executable exe 5170ff37a0d0a1ba65b92926cc920a9ee99e439ae6ff1dc268e61ab4f58089e1

  
Dropping
Ursu
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/67953/
  
Dropping
SHA256 5170ff37a0d0a1ba65b92926cc920a9ee99e439ae6ff1dc268e61ab4f58089e1
  
Dropping
MD5 5661f511548d49035ec371194f9a7be7

Comments