MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b384f43a2818ff05307d3559f82e00c33efc45b86ffbb1efe5c2d15716ce6b6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | b384f43a2818ff05307d3559f82e00c33efc45b86ffbb1efe5c2d15716ce6b6c |
|---|---|
| SHA3-384 hash: | 392facfdbdde9643cf31da1403f421279da3224bb363ef1acc2a4b381f46dc6dc1a231b0f0b53bf39f9fe9d24544ee4c |
| SHA1 hash: | ae057c255dfc962447c98da603c2baf3c9044ae9 |
| MD5 hash: | 2b40a904ca1035eade33cd74e6219c0a |
| humanhash: | diet-don-william-low |
| File name: | sysctle.exe |
| Download: | download sample |
| File size: | 4'809'284 bytes |
| First seen: | 2022-06-30 08:23:37 UTC |
| Last seen: | 2022-06-30 08:39:17 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5a594319a0d69dbc452e748bcf05892e (21 x ParallaxRAT, 20 x Gh0stRAT, 15 x NetSupport) |
| ssdeep | 98304:8SiJ3GKQf9AAHciIQ7m3KJBz+36+zn715Z3PQC5Wle0ITCo:S3GKQi5iI4mzn55Z3Pl10/o |
| Threatray | 13 similar samples on MalwareBazaar |
| TLSH | T1E326123FF268A13EC4AA1B3245B39250587BBA65780A8C1E07FC394DCF765701E3B656 |
| TrID | 49.7% (.EXE) Inno Setup installer (109740/4/30) 19.5% (.EXE) InstallShield setup (43053/19/16) 18.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 4.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.0% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 5050d270cccc82ae (109 x Adware.Generic, 43 x LummaStealer, 42 x OffLoader) |
| Reporter |  stoerchl |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
217
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Enabling the 'hidden' option for recently created files
Creating a file
Running batch commands
Launching a process
Adding an access-denied ACE
Launching a tool to kill processes
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Sending a TCP request to an infection source
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckNumberOfProcessor
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
60%
Tags:
overlay packed setupapi.dll shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
92 / 100
Signature
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file contains section with special chars
Queries disk data (e.g. SMART data)
Snort IDS alert for network traffic
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 3 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
bootkit discovery persistence suricata
Behaviour
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Writes to the Master Boot Record (MBR)
Checks computer location settings
Deletes itself
Drops startup file
Loads dropped DLL
Modifies file permissions
Executes dropped EXE
suricata: ET MALWARE Win32/Delf.BLL Variant CnC Activity (Inbound)
suricata: ET MALWARE Win32/Delf.BLL Variant CnC Activity (Outbound)
Unpacked files
SH256 hash:
dae3e86d0edc2f2da40d075def80b57c989614cedcd916f83c9b89f7202216da
MD5 hash:
af35ead2d618bf7b43ed32b16f3ea1a6
SHA1 hash:
f064f108837dc084df735a8a99eaca8c5422035a
SH256 hash:
4398416ec84b1e80876d5ced3b595cd2ac5685954c179c37c2253b6c76539054
MD5 hash:
c8c179caa75e7da9ac8aea69ec7b8245
SHA1 hash:
2ee1c267e3e94c51f766109f17621df7599d64b7
SH256 hash:
992333b8c5f916ccf849dd1132e2f13e0c510fa371bf3ba4afae40d6e06be293
MD5 hash:
ad38103ee2d9f304b2f3bad576e0659a
SHA1 hash:
d1c4a477428c1095d5c43cd2427e19374870646f
SH256 hash:
b384f43a2818ff05307d3559f82e00c33efc45b86ffbb1efe5c2d15716ce6b6c
MD5 hash:
2b40a904ca1035eade33cd74e6219c0a
SHA1 hash:
ae057c255dfc962447c98da603c2baf3c9044ae9
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.