MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba2915408efe22a4296779cace54a64f58f5642d4add478ff79d26c094dcf916. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba2915408efe22a4296779cace54a64f58f5642d4add478ff79d26c094dcf916
SHA3-384 hash: 79c7349a7e08e87aa890a71f1f0bef7f2ee7ed051a81a326285414720569afe9a64315eaf558aef58f18ed5f0f11a17f
SHA1 hash: f9102950c8272c2837002683a538644fb324f155
MD5 hash: 7c76401cd857ef054926c34e9ac03750
humanhash: december-missouri-robin-comet
File name:virussign.com_7c76401cd857ef054926c34e9ac03750
Download: download sample
File size:476'548 bytes
First seen:2022-07-15 16:50:48 UTC
Last seen:2024-07-24 20:48:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 87bed5a7cba00c7e1f4015f1bdae2183 (3'034 x Jadtre, 23 x IcedID, 17 x Blackmoon)
ssdeep 6144:8cm7ImGddXmNt251UriZFwT+aZKl2Uj2Og6bZfH:q7Tc2NYHUrAwT+OKQ/Og6x
Threatray 121 similar samples on MalwareBazaar
TLSH T1B4A495B21F3DE5B7E6B0F47056A91164288EB27B89C929F450E113881B79CC1D9C2DBF
Reporter KdssSupport
Tags:exe


Avatar
KdssSupport
Uploaded with API

Intelligence

File Origin
# of uploads :
2
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/290166/
Detection(s):
Win.Malware.Dinwod-9828955-0
Create hunting rule

Win.Trojan.Dinwod-9866281-0
Create hunting rule

Win.Trojan.Agent-1388682
Create hunting rule

Win.Malware.Babar-6870795-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/25842/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/62d19b4a3ec0b068997be15c/reports/1057974a-0636-477f-a72a-8298a60e24e6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1034098
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 666592 Sample: NQZYRkj66c.com_7c76401cd857... Startdate: 17/07/2022 Architecture: WINDOWS Score: 84 104 Malicious sample detected (through community Yara rule) 2->104 106 Antivirus detection for dropped file 2->106 108 Antivirus / Scanner detection for submitted sample 2->108 110 3 other signatures 2->110 14 NQZYRkj66c.exe 1 2->14         started        process3 file4 90 C:\roc09gw.exe, PE32 14->90 dropped 148 Tries to detect virtualization through RDTSC time measurements 14->148 18 roc09gw.exe 1 14->18         started        22 b167531.exe 1 14->22         started        signatures5 process6 file7 70 C:\n257n50.exe, PE32 18->70 dropped 112 Antivirus detection for dropped file 18->112 114 Machine Learning detection for dropped file 18->114 116 Tries to detect virtualization through RDTSC time measurements 18->116 24 n257n50.exe 1 18->24         started        72 C:\qbsmga.exe, PE32 22->72 dropped 28 qbsmga.exe 1 22->28         started        signatures8 process9 file10 80 C:\6whasmg.exe, PE32 24->80 dropped 130 Antivirus detection for dropped file 24->130 132 Machine Learning detection for dropped file 24->132 134 Tries to detect virtualization through RDTSC time measurements 24->134 30 6whasmg.exe 1 24->30         started        82 C:\p0w80.exe, PE32 28->82 dropped 34 p0w80.exe 1 28->34         started        signatures11 process12 file13 92 C:\9n7231.exe, PE32 30->92 dropped 150 Antivirus detection for dropped file 30->150 152 Machine Learning detection for dropped file 30->152 154 Tries to detect virtualization through RDTSC time measurements 30->154 36 9n7231.exe 1 30->36         started        94 C:\vd1pf.exe, PE32 34->94 dropped 40 vd1pf.exe 1 34->40         started        signatures14 process15 file16 74 C:\6ufwq.exe, PE32 36->74 dropped 118 Antivirus detection for dropped file 36->118 120 Machine Learning detection for dropped file 36->120 122 Tries to detect virtualization through RDTSC time measurements 36->122 42 6ufwq.exe 1 36->42         started        76 C:\t5w68gp.exe, PE32 40->76 dropped 46 t5w68gp.exe 40->46         started        signatures17 process18 file19 84 C:\32124k8.exe, PE32 42->84 dropped 136 Antivirus detection for dropped file 42->136 138 Machine Learning detection for dropped file 42->138 140 Tries to detect virtualization through RDTSC time measurements 42->140 48 32124k8.exe 1 42->48         started        86 C:\pf501.exe, PE32 46->86 dropped 52 pf501.exe 46->52         started        signatures20 process21 file22 66 C:\1n9q02k.exe, PE32 48->66 dropped 98 Antivirus detection for dropped file 48->98 100 Machine Learning detection for dropped file 48->100 102 Tries to detect virtualization through RDTSC time measurements 48->102 54 1n9q02k.exe 1 48->54         started        68 C:\ma63lb.exe, PE32 52->68 dropped signatures23 process24 file25 78 C:\o8ktmga.exe, PE32 54->78 dropped 124 Antivirus detection for dropped file 54->124 126 Machine Learning detection for dropped file 54->126 128 Tries to detect virtualization through RDTSC time measurements 54->128 58 o8ktmga.exe 1 54->58         started        signatures26 process27 file28 88 C:\h167531.exe, PE32 58->88 dropped 142 Antivirus detection for dropped file 58->142 144 Machine Learning detection for dropped file 58->144 146 Tries to detect virtualization through RDTSC time measurements 58->146 62 h167531.exe 1 58->62         started        signatures29 process30 file31 96 C:\60o29.exe, PE32 62->96 dropped 156 Antivirus detection for dropped file 62->156 158 Machine Learning detection for dropped file 62->158 160 Tries to detect virtualization through RDTSC time measurements 62->160 signatures32
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba2915408efe22a4296779cace54a64f58f5642d4add478ff79d26c094dcf916/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2022-07-10 02:11:43 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
26 of 26 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xiurkqeo7yrkiklhphfm4vfgj5mpkzbnjloupd7xtutmbfg47ela._file
Verdict:
malicious
Similar samples:
37c1c22c88f4bb3fb1810466886d6e56aaad3e128a1f902d5122b1b67a80d750
42bd47a6689ce5024e520fe761491ba59d519afbc5df55e7e8d0bf32a0552335
707195193abd26e19a2042286ef8d311ae3d7090077b4772d4d040ab846750e3
715c74876db82208d4e5b3b380dc41ba69cc9e3e4f217437359b587c2847b54f
9d66fc7b5542b1c4308c05b0daddfd3982557763f5786f75adaab31038f30be1
b3dcb9d04c53f00a1f5f67d035b32fb0a86b4e76a5525d7cfbd68caee7ad8ba0
bdaabdf3edaa5174c327d655c06ebe6feea74325c65971434ae87e71a5621815
bee0ea996b66f2bab86487a4fb829853a7a2a4d7c9c3195644df8e10d095a24e
c648471bdaee4203dd17d4e5c19d12357feb4b5a6b1e7e855a5cce3f70f110d0
d2764aec8fcdcc44b001321cd5f6327b23a9644d13c48abbc37b06ff0b379630
+ 111 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/220715-vctrxsdfdl/
Behaviour
Suspicious use of WriteProcessMemory
Executes dropped EXE
UPX packed file
Unpacked files
SH256 hash:
ba2915408efe22a4296779cace54a64f58f5642d4add478ff79d26c094dcf916
MD5 hash:
7c76401cd857ef054926c34e9ac03750
SHA1 hash:
f9102950c8272c2837002683a538644fb324f155
Link:
https://www.unpac.me/results/831bd54f-8840-4db6-8d9d-6fd1bc15cb0c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba2915408efe22a4296779cace54a64f58f5642d4add478ff79d26c094dcf916

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe ba2915408efe22a4296779cace54a64f58f5642d4add478ff79d26c094dcf916

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/290166/

Comments