MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6c29dc2196684979e92e29a4fa22efdfac123589329b6c28a4af79067318049. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6c29dc2196684979e92e29a4fa22efdfac123589329b6c28a4af79067318049
SHA3-384 hash: 31666e90a5ef720f5a8b716eeee693426244de307bf51de8d1f0535fe2bbe9def319609bc871b14e88ed6d52afac76ab
SHA1 hash: 5e421bd40e18534f7e7bf5e4c015b35b557d8a74
MD5 hash: b93783d77c179c4d7655bbb83293316b
humanhash: five-florida-missouri-east
File name:file
Download: download sample
File size:6'422'528 bytes
First seen:2022-11-16 21:21:11 UTC
Last seen:2022-11-16 22:45:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 29c17aa1f75d5ec7b02c9207993a6c14
ssdeep 98304:/x+dbd33oSpsJu9oR+bY11UhoIwBOqF85EiqrvBb2s4U5OoNkI9xFvPrBtOsdQa:5+BzpWu891ZDBOr+iqrpbTLp/I
TLSH T1A7562310B2599966E2139130881BC9F6432A7D7DD74389BB32D9BF4F3AB23D0417BA16
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 68d4aa888c8ac460 (2 x AgentTesla, 2 x SnakeKeylogger, 2 x AsyncRAT)
Reporter jstrosch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
236
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
No threats detected
Analysis date:
2022-11-16 21:27:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f4639609-4ea6-4a70-b503-41a43d3afe8c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/335082/
Detection(s):
SecuriteInfo.com.Variant.Lazy.260895.13474.7057.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug greyware packed
Link:
https://www.filescan.io/uploads/6375547d07c3f5e84a018243/reports/13324816-c451-494e-aaf6-a2a822b1cfa6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/71153d55-696e-481b-af80-523e4b79f81e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1115321
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Machine Learning detection for sample
Modifies the windows firewall
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sample uses process hollowing technique
Snort IDS alert for network traffic
Tries to detect virtualization through RDTSC time measurements
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 748026 Sample: file.exe Startdate: 16/11/2022 Architecture: WINDOWS Score: 100 60 Snort IDS alert for network traffic 2->60 62 Antivirus / Scanner detection for submitted sample 2->62 64 Multi AV Scanner detection for submitted file 2->64 66 Machine Learning detection for sample 2->66 8 file.exe 1 2->8         started        12 file.exe 2->12         started        14 file.exe 2->14         started        process3 file4 46 C:\WindowsbehaviorgraphoogleUpdate.exe, PE32 8->46 dropped 68 Encrypted powershell cmdline option found 8->68 70 Drops executables to the windows directory (C:\Windows) and starts them 8->70 72 Uses schtasks.exe or at.exe to add and modify task schedules 8->72 74 4 other signatures 8->74 16 GoogleUpdate.exe 12 8->16         started        20 powershell.exe 21 8->20         started        22 powershell.exe 21 8->22         started        24 2 other processes 8->24 signatures5 process6 dnsIp7 48 api.peer2profit.com 172.66.40.196, 443, 49696, 49698 CLOUDFLARENETUS United States 16->48 50 141.95.93.188, 443, 49697, 49699 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese Germany 16->50 52 Detected unpacking (changes PE section rights) 16->52 54 Detected unpacking (overwrites its own PE header) 16->54 56 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 16->56 58 3 other signatures 16->58 26 netsh.exe 3 16->26         started        28 netsh.exe 3 16->28         started        30 netsh.exe 3 16->30         started        32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        36 conhost.exe 24->36         started        38 conhost.exe 24->38         started        signatures8 process9 process10 40 conhost.exe 26->40         started        42 conhost.exe 28->42         started        44 conhost.exe 30->44         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6c29dc2196684979e92e29a4fa22efdfac123589329b6c28a4af79067318049/
Threat name:
Win32.Trojan.Lazy
Create hunting rule
Status:
Malicious
First seen:
2022-11-13 20:17:00 UTC
File Type:
PE (Exe)
Extracted files:
138
AV detection:
22 of 41 (53.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w3bj3qqzm2cjphus4kne7iro7x5mci2ysmu3nqukjl3zazzrqbeq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
evasion vmprotect
Link:
https://tria.ge/reports/221116-z7wxzsda48/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Executes dropped EXE
Modifies Windows Firewall
VMProtect packed file
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/65fda94d-dc62-4d2c-bf7c-04ec37de067f
Unpacked files
SH256 hash:
b6c29dc2196684979e92e29a4fa22efdfac123589329b6c28a4af79067318049
MD5 hash:
b93783d77c179c4d7655bbb83293316b
SHA1 hash:
5e421bd40e18534f7e7bf5e4c015b35b557d8a74
Link:
https://www.unpac.me/results/21f1ec07-5f2e-41c7-8824-2422867feb7b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b6c29dc21966/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b6c29dc2196684979e92e29a4fa22efdfac123589329b6c28a4af79067318049

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe b6c29dc2196684979e92e29a4fa22efdfac123589329b6c28a4af79067318049

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/335082/
  
URLhaus
https://urlhaus.abuse.ch/url/2422308/

Comments