MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b36d52d06cadfa7a2a60e56e783bc6ca26a30b3769762ec0659c016b0f52dd57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b36d52d06cadfa7a2a60e56e783bc6ca26a30b3769762ec0659c016b0f52dd57
SHA3-384 hash: a4ef51398033e8c25f92b24c0a6175b3886d65d5f6291a8eabe88296a5367a41d2ad1964e22c31ab9ed57cd656d954f1
SHA1 hash: 7b2cbc85b53f063151890f2784dd72e27b379a79
MD5 hash: a184207c11735d200b92dab190bcfdfa
humanhash: butter-missouri-fix-fillet
File name:a184207c11735d200b92dab190bcfdfa.exe
Download: download sample
File size:1'447'936 bytes
First seen:2023-06-25 07:41:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fbf286c9ce76265e80d8e6163a44efba (39 x RedLineStealer, 13 x Amadey)
ssdeep 24576:yHJI4g+aH/hY1wfvW6asX/LrI4+Z241F+CwWp3LbtzyhOVoPQ8ImxXyOczK+ibF1:yHi4bafRFDsxX+CRLp2hOgNJ4qPP/C+t
Threatray 4 similar samples on MalwareBazaar
TLSH T1D265F19B3988C177D9641531E1EFC3235E197AB1061FB88FAB270A3BDA635ACD43E444
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
264
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a184207c11735d200b92dab190bcfdfa.exe
Verdict:
No threats detected
Analysis date:
2023-06-25 07:42:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ce0eb8f7-f3b8-4ca6-9a12-8fec5cb4b1a9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/402588/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67732725.24875.9128.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
DNS request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/92626/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/6497efcb76927ec2c00776b0/reports/19c35b73-e050-4542-9e3c-2bdc8ec44419/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/b36d52d06cadfa7a2a60e56e783bc6ca26a30b3769762ec0659c016b0f52dd57
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4a5d487d-8440-467d-b0d1-54ef6bde08b9
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1261033
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 894051 Sample: A8VAOJTI0Z.exe Startdate: 25/06/2023 Architecture: WINDOWS Score: 52 15 Multi AV Scanner detection for submitted file 2->15 17 Machine Learning detection for sample 2->17 6 A8VAOJTI0Z.exe 1 2->6         started        process3 process4 8 WerFault.exe 23 9 6->8         started        11 conhost.exe 6->11         started        file5 13 C:\ProgramData\Microsoft\...\Report.wer, Unicode 8->13 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b36d52d06cadfa7a2a60e56e783bc6ca26a30b3769762ec0659c016b0f52dd57/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2023-06-24 04:50:12 UTC
File Type:
PE (Exe)
AV detection:
17 of 37 (45.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wnwvfudmvx5hukta4vxhqo6gzitkgczxnf3c5qdftqawwd2s3vlq._file
Verdict:
malicious
Similar samples:
8868862d704985cba3844bfd123b674487132dccfbce744b80d1528b4b6a64b2
cb72552001ee910a20ce701f76df4b4e86471e76f633778c910e6ad85741bd33
d5b7dbc1600edcd964394c04bdc4682cdb673943548402f70a876f3543868d63
e69a25d7c176de56ba98ac3b16cb7911a75b503ff45370dc8ad61cf06c98576c
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230625-jjpk1add84/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
d9b807b461ef7100827f6ff4b219b3e4af731cb9b946724197e57a78e77588a3
MD5 hash:
067bbb92eed93f3c3182bae1c4ff4c4a
SHA1 hash:
930dbf53129516eafb8439321cafa4b34548be3d
Link:
https://www.unpac.me/results/c7fecd69-f142-48ca-a6a2-66460125038a/
SH256 hash:
b36d52d06cadfa7a2a60e56e783bc6ca26a30b3769762ec0659c016b0f52dd57
MD5 hash:
a184207c11735d200b92dab190bcfdfa
SHA1 hash:
7b2cbc85b53f063151890f2784dd72e27b379a79
Link:
https://www.unpac.me/results/c7fecd69-f142-48ca-a6a2-66460125038a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b36d52d06cadfa7a2a60e56e783bc6ca26a30b3769762ec0659c016b0f52dd57

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe b36d52d06cadfa7a2a60e56e783bc6ca26a30b3769762ec0659c016b0f52dd57

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2665597/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/402588/

Comments