MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b461d9bfbeae78742a553e7256a7714c5b24f99f032e3f3779b31c3af2458807. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b461d9bfbeae78742a553e7256a7714c5b24f99f032e3f3779b31c3af2458807
SHA3-384 hash: 2826de3ef2409cdb9a716ff7885200f53de1f0100456b6f7b131928a021bf2d2cf074ca8095f5b724aa217d1f2cf1ff0
SHA1 hash: 656087fbe04932beda215c94efac24d7f8cc01cf
MD5 hash: b6f6458f4d4d2bf060ce825c732c8c5d
humanhash: pip-zulu-eighteen-steak
File name:b6f6458f4d4d2bf060ce825c732c8c5d.exe
Download: download sample
File size:10'615'808 bytes
First seen:2023-01-27 14:14:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 38884057b610520849299965eb44b13b
ssdeep 196608:6RIaUXo8glVvd3nhyrQMpkq9Y0BSMq8/aZoR+xtUp/Z3/TGZ:cIa/lVvd3hyrmqy0Nq8/8RbUlZP6Z
Threatray 14 similar samples on MalwareBazaar
TLSH T16CB623D294D916F4E88ACB75534F3B8EA1E0F6561E75B52E3AC11C03CA30FDA014AB67
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b6f6458f4d4d2bf060ce825c732c8c5d.exe
Verdict:
Malicious activity
Analysis date:
2023-01-27 14:33:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b344d04d-885c-455f-8e1e-519954f27471

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/357441/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Enabling the 'hidden' option for recently created files
Sending a custom TCP request
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/63445/overview
Behaviour
MalwareBazaar
Verdict:
No Threat
Threat level:
  2/10
Confidence:
67%
Tags:
packed
Link:
https://www.filescan.io/uploads/63d3dc672d4f6d560e234686/reports/566de6c5-3254-47fb-be1a-b182f7c12906/overview
Result
Verdict:
MALICIOUS
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/9a60f1be-2809-4ba8-8bca-54ace979f737
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1160418
Signature
Antivirus detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 793154 Sample: M1KWogUsFa.exe Startdate: 27/01/2023 Architecture: WINDOWS Score: 76 31 Antivirus detection for dropped file 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 Machine Learning detection for sample 2->35 37 PE file contains section with special chars 2->37 7 M1KWogUsFa.exe 4 2->7         started        process3 file4 27 C:\...\WlndowsDraiver-Ver2.4.9.5.exe, PE32+ 7->27 dropped 29 WlndowsDraiver-Ver...exe:Zone.Identifier, ASCII 7->29 dropped 39 Query firmware table information (likely to detect VMs) 7->39 41 Uses schtasks.exe or at.exe to add and modify task schedules 7->41 43 Tries to detect sandboxes / dynamic malware analysis system (registry check) 7->43 11 icacls.exe 1 7->11         started        13 icacls.exe 1 7->13         started        15 schtasks.exe 1 7->15         started        17 icacls.exe 1 7->17         started        signatures5 process6 process7 19 conhost.exe 11->19         started        21 conhost.exe 13->21         started        23 conhost.exe 15->23         started        25 conhost.exe 17->25         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b461d9bfbeae78742a553e7256a7714c5b24f99f032e3f3779b31c3af2458807/
Threat name:
Win64.Trojan.Tasker
Create hunting rule
Status:
Malicious
First seen:
2023-01-27 14:15:08 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
13 of 39 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wrq5tp56vz4hiksvhzzfnj3rjrnsj6m7amxd6n3zwmodv4sfradq._file
Verdict:
malicious
Similar samples:
0d272083d39759e5b5408290740e598bd7df649d5a3db280543b56eaa3637454
5280df289219b64295e97b3b94e61b34e93a2fa9796067a447b7695499711e97
61f1a2d39b49ded2ad9e84f9826a33c20e8f35e11ecc43d3eac4e076d6d33caf
90e7c78ca1612b6f6e0f2c25e00e4c73e9df86936a243a03a488a3b155334eea
a43b6e7f55eed94ef6438e821506cbc12cb95fcd00b2bc135b130d6880fa0a30
b7e70119bad5c9fcd84035b4b9064911f45f0e95a2ec4a84b0ee10105d541055
c7d11c958c790562daf2522a05d7ba39e0c013e810f51ff2013af571d9394679
ceb3007d4015dd96043315cd91f6c4ff82da1b206921311c8833d76947e92702
+ 4 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
discovery evasion persistence trojan
Link:
https://tria.ge/reports/230127-rkj1xada6y/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks whether UAC is enabled
Checks BIOS information in registry
Checks computer location settings
Loads dropped DLL
Modifies file permissions
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
b461d9bfbeae78742a553e7256a7714c5b24f99f032e3f3779b31c3af2458807
MD5 hash:
b6f6458f4d4d2bf060ce825c732c8c5d
SHA1 hash:
656087fbe04932beda215c94efac24d7f8cc01cf
Link:
https://www.unpac.me/results/c8adc297-7e5e-4ee9-ba8b-661d76f1cbcc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b461d9bfbeae78742a553e7256a7714c5b24f99f032e3f3779b31c3af2458807

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/357441/

Comments