MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b983faf575bfae3a6a10bcfde6fe7e7ecc0716ae285723e01876fe48faeb100f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b983faf575bfae3a6a10bcfde6fe7e7ecc0716ae285723e01876fe48faeb100f
SHA3-384 hash: f42f7951234a369b678187f3a30dd8ed0cdc102adc849b9c7812b57c028bfb5dc446a492bab4bee61b04b7c95b7c284b
SHA1 hash: f1e27b42f8369dcfc08de3b2f4a340100a889f0b
MD5 hash: 6b32f7aabb31b102d98a69bbcfde0bac
humanhash: johnny-cat-south-summer
File name:Irdnrzdakhk.dll
Download: download sample
File size:1'083'392 bytes
First seen:2023-10-23 17:03:41 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 24576:AQV0Gf28ZeqiJtlOMDAMDqJVuuvYnsz27rsvIx8qu7a:ANGe8wqiNLDqWuvYswme8a
Threatray 13 similar samples on MalwareBazaar
TLSH T14835236CA74BDBAAD8EC28F668E27F940374C877D78BE3572DC945E108223E7581051B
TrID 87.2% (.DLL) Generic .NET DLL/Assembly (236632/4/32)
3.8% (.EXE) Win64 Executable (generic) (10523/12/4)
2.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.6% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter James_inthe_box
Tags:dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
287
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.63.4494.25322.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Labled as:
Variadic.A.461.Generic
Link:
https://www.hybrid-analysis.com/sample/b983faf575bfae3a6a10bcfde6fe7e7ecc0716ae285723e01876fe48faeb100f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1d15efd6-c761-42b5-91c0-8285e712f455
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1330748
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1330748 Sample: Irdnrzdakhk.dll Startdate: 23/10/2023 Architecture: WINDOWS Score: 56 15 Antivirus / Scanner detection for submitted sample 2->15 17 .NET source code contains potential unpacker 2->17 19 Machine Learning detection for sample 2->19 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        process5 13 rundll32.exe 9->13         started       
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b983faf575bfae3a6a10bcfde6fe7e7ecc0716ae285723e01876fe48faeb100f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b983faf575bfae3a6a10bcfde6fe7e7ecc0716ae285723e01876fe48faeb100f/
Threat name:
ByteCode-MSIL.Trojan.Variadic
Create hunting rule
Status:
Malicious
First seen:
2023-10-23 17:02:10 UTC
File Type:
PE (.Net Dll)
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xgb7v5lvx6xdu2qqxt66n7t6p3gaofvofblshyayo37er6xlcahq._file
Verdict:
malicious
Similar samples:
1ecf4a80641db7366f049cd1a60eb75d36eb68578d5e71e4e72d2474aa9be7bc
4e4c154f0500990e897ca9650eafd3c6255ba4df3b4bc620c6ba27b718278392
65c4d932a71d1f36d1c57b7ed319c20446d3c935b60f8f1262bc047e1c6556ff
6e006fa2cf49e2c52add436f266e2f62fb53ec936dd3caf536749d859240d6ae
6fc7189791af4f2f113700770fc02ccde3e34cdbb2d886ce7e9699a27ddac970
72e5420f9ce8e361479ffa0959e14c29d10b3112c0cbafbde4554506d1bd665a
a830eaba9888a6fa0a3cbf85da3636f1c41ae7a0372cbc5cfab0efd197894fc9
b916d475339eb0e64ad8e4e8bf897adb317c8add907ca4f72c1b7fda76cd8550
c5bf13f324052f8e3240024494c7c4bf809e3c423a59fabd0cd067e01a990ee6
+ 3 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/231023-vk87ksba4x/
Unpacked files
SH256 hash:
b983faf575bfae3a6a10bcfde6fe7e7ecc0716ae285723e01876fe48faeb100f
MD5 hash:
6b32f7aabb31b102d98a69bbcfde0bac
SHA1 hash:
f1e27b42f8369dcfc08de3b2f4a340100a889f0b
Link:
https://www.unpac.me/results/0366bfd6-48b3-4acc-98ed-12b0812c0748/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b983faf575bfae3a6a10bcfde6fe7e7ecc0716ae285723e01876fe48faeb100f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments