MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b70bc0d3f99e0c3f3f4ab47d54785cad1525dfa6369b99711f7b2f011d99799d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b70bc0d3f99e0c3f3f4ab47d54785cad1525dfa6369b99711f7b2f011d99799d
SHA3-384 hash: 6a3fd7a10895b296ec2b1e89b61eadb3220f6521300fb5859c9b75885e7f14d2376393732ea02de90eb4ffd52094c042
SHA1 hash: c115cfb3c60ff46db491a6b184ec3d26d4afc2a4
MD5 hash: 1bdf9ab499b518e7738cf8209e0f27c9
humanhash: xray-idaho-aspen-colorado
File name:setup331.exe1
Download: download sample
File size:1'644'625 bytes
First seen:2022-07-07 13:45:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b4070734502a100c8f90bbd445995533 (11 x CryptOne, 5 x DCRat, 2 x njrat)
ssdeep 24576:9GHCm8uPdJmX25KrBaRsoy5fZFLQzLwjDNyB6t5ca6tmfRJHrXIu2DN:EuWx+alIjLiOSa6tmLXw
Threatray 1'262 similar samples on MalwareBazaar
TLSH T1127512C2BDD48CF9F1611439C7209A5CE9A8BD62BFFD85CE1350990BD8F10C2953A66E
TrID 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10523/12/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter KdssSupport
Tags:exe


Avatar
KdssSupport
Uploaded with API

Intelligence

File Origin
# of uploads :
1
# of downloads :
244
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/285536/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Steam.28157.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.IL.Trojan.MSILMamut.499.423.467.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/24347/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/62c6e3e16ee6df015bbf2cd2/reports/b643d51c-e00d-479c-9581-9d4818e39bdd/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e27b6fa8-798b-4016-92b3-7d27ebe7f053
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1026493
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 658990 Sample: setup331.exe1 Startdate: 07/07/2022 Architecture: WINDOWS Score: 48 13 Multi AV Scanner detection for submitted file 2->13 6 setup331.exe 8 2->6         started        process3 file4 11 C:\Users\user\AppData\Local\...\2X1WhHr.x81, PE32 6->11 dropped 9 regsvr32.exe 6->9         started        process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b70bc0d3f99e0c3f3f4ab47d54785cad1525dfa6369b99711f7b2f011d99799d/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-07-07 14:19:53 UTC
AV detection:
18 of 25 (72.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w4f4bu7ztygd6p2kwr6vi6c4vukslx5gg2nzs4i7pmxqchmzpgoq._file
Verdict:
malicious
Similar samples:
02fb1251acee80ba75a46ec46d3722dbfad5531df786601c9a46e12a24240071
2009b8f4c568a316978b7bc19bddac9dd20ff8e2d796a44f355a3635ffc3b76e
3e7cf8b2e3f6d13ecfccc5eb1cfb57dfe12303e3315500cecf37f53687a3c784
4fc7f1f57853c21506349c98a90fce183a1e68509ea78fbea79e22c13bec4ad2
5c729dcf3f65f1a27e00e7597b5c8897d59c191dc0649718c46cc503abe88148
862436265855ac8c2d4c8517da3d7f7572c57ccb520f6f76c18348fcaa893503
b9738738d885cb91e88c24692c61f6c1459992420a01bc061239d682cc7eabf6
+ 1'252 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/220707-q2ypysagf6/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Unpacked files
SH256 hash:
b70bc0d3f99e0c3f3f4ab47d54785cad1525dfa6369b99711f7b2f011d99799d
MD5 hash:
1bdf9ab499b518e7738cf8209e0f27c9
SHA1 hash:
c115cfb3c60ff46db491a6b184ec3d26d4afc2a4
Link:
https://www.unpac.me/results/1907d3f0-150c-4597-b0bd-eb7a5af73705/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b70bc0d3f99e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b70bc0d3f99e0c3f3f4ab47d54785cad1525dfa6369b99711f7b2f011d99799d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:suspicious_sfx_files_size_rule
Create hunting rule
Author:Razvan.A.B
Description:Detects suspicious files containing sfx

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe b70bc0d3f99e0c3f3f4ab47d54785cad1525dfa6369b99711f7b2f011d99799d

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/285536/

Comments