MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b653a89e2a50d9f48353c875198d7f64344d227accdc5c8bd35823502800842b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b653a89e2a50d9f48353c875198d7f64344d227accdc5c8bd35823502800842b
SHA3-384 hash: 1e0e6c9a00d7dbb6e7556e55eb71b1de5b7ac2341b30ceb9fcc86e780549e6acb1ec60b91f81e59f46c9bc4b99df0197
SHA1 hash: 4c16385554f31b237336e0ec27674127ba9dd735
MD5 hash: 5bacad997fee21b16c7265d27f8cf2f7
humanhash: mars-twelve-undress-magazine
File name:SecuriteInfo.com.Win32.Evo-gen.29934.27343
Download: download sample
File size:2'330'434 bytes
First seen:2023-09-30 19:38:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4ba3ea0d6362a841ec66a1fc0a1b874f
ssdeep 49152:ufC4M200n9b3Dd0iefUpYpYsEWFSrV5N7mAui+wSnpgrEIr:jxk350HfUOhEWFSr7xu4SpdIr
Threatray 6 similar samples on MalwareBazaar
TLSH T17BB5336136D1D2FFEE933430DD1466B9D0F4C7885B12AE938FC0D7069E3C09156ABA9A
TrID 38.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
24.6% (.EXE) Win64 Executable (generic) (10523/12/4)
11.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.5% (.EXE) Win32 Executable (generic) (4505/5/1)
4.7% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
279
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/452370/
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.29934.27343.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Running batch commands
Launching a process
Сreating synchronization primitives
Creating a process with a hidden window
Searching for the window
Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
installer lolbin overlay packed SFX shell32
Link:
https://www.filescan.io/uploads/651879571edabd9982a26660/reports/23c01e3a-89e4-4867-8671-582c8fe2aa69/overview
Verdict:
Malicious
Labled as:
Trojan.DuckTail
Link:
https://www.hybrid-analysis.com/sample/b653a89e2a50d9f48353c875198d7f64344d227accdc5c8bd35823502800842b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f201004b-58e1-4ca5-9eea-d915f64897ff
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1317349
Signature
Antivirus detection for dropped file
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1317349 Sample: SecuriteInfo.com.Win32.Evo-... Startdate: 30/09/2023 Architecture: WINDOWS Score: 60 27 Antivirus detection for dropped file 2->27 29 Machine Learning detection for sample 2->29 31 Machine Learning detection for dropped file 2->31 33 PE file contains section with special chars 2->33 10 SecuriteInfo.com.Win32.Evo-gen.29934.27343.exe 3 2->10         started        process3 file4 25 C:\Users\user\AppData\Local\...\qEGMnP.lV, PE32 10->25 dropped 13 cmd.exe 1 10->13         started        process5 process6 15 control.exe 1 13->15         started        17 conhost.exe 13->17         started        process7 19 rundll32.exe 15->19         started        process8 21 rundll32.exe 19->21         started        process9 23 rundll32.exe 21->23         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b653a89e2a50d9f48353c875198d7f64344d227accdc5c8bd35823502800842b/
Threat name:
Win32.Trojan.Babar
Create hunting rule
Status:
Malicious
First seen:
2023-09-30 19:39:05 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
13 of 23 (56.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wzj2rhrkkdm7ja2tzb2rtdl7mq2e2it2ztofzc6tlarvakaaqqvq._file
Verdict:
malicious
Similar samples:
64119e925a2c5fe96481a18acdab674856490be0a3051e5e4508ac20a83ad42e
657ce9b72278bcbc3d100ea8a012381ceee3402bcb19977befb69f4d7459275b
71ba25a8276d119cdf3249f4f5427a2b2b07ba291434ede3d0d84bed4143cc63
8d0191d24b9d62100603d7640fe138d5eb005f758fa77cbcf0434e317286db6c
da9556ef3fd609709cc07f635978b1d428cd8bd681ebbe1679b5f7c10fa0270e
fc73b102e40787082518533d6c871d300ce4c4bcb83700e0c21b5e4fc6098203
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230930-ycybwsge76/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Unpacked files
SH256 hash:
b653a89e2a50d9f48353c875198d7f64344d227accdc5c8bd35823502800842b
MD5 hash:
5bacad997fee21b16c7265d27f8cf2f7
SHA1 hash:
4c16385554f31b237336e0ec27674127ba9dd735
Link:
https://www.unpac.me/results/0ab77bdc-f3b0-4849-93a6-c0d7e8ca7697/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b653a89e2a50d9f48353c875198d7f64344d227accdc5c8bd35823502800842b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/452370/

Comments