MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba52afc3af14ee1c1310b78749df19e172aa004d356a8d974a6a00e7c9edf367. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba52afc3af14ee1c1310b78749df19e172aa004d356a8d974a6a00e7c9edf367
SHA3-384 hash: 15a6adb1b3dbcc199825c0369c9ec704af1978d1c78ea370b6df3bcd278b46f237e8f0b7cb344dc1607f94fde1f0b651
SHA1 hash: b3bb7761bf51d2ae00733bb1d609ba153743d4eb
MD5 hash: 45d4118084ecd3a0b0d1d774975dea26
humanhash: sodium-high-spaghetti-lemon
File name:SecuriteInfo.com.Win32.TrojanX-gen.18348.29040
Download: download sample
File size:15'360 bytes
First seen:2023-07-26 15:34:21 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 3fb7ec92dc5428dc25b22a2c07c4e9d8
ssdeep 384:Tr5ZDtrFAsVnIhdP3RmCT3pGyGtknOdw:TvIsVI5pGyGt
Threatray 2'322 similar samples on MalwareBazaar
TLSH T1CD627D75CF974078CFAD5FB00AEA5D2F5604AA69324801904F271F4E9CA1BA7FE4348E
TrID 30.2% (.EXE) Win64 Executable (generic) (10523/12/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4505/5/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
249
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/434122/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.18348.29040.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ba52afc3af14ee1c1310b78749df19e172aa004d356a8d974a6a00e7c9edf367
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/254ded29-46c3-4d75-9a93-e7d9ed9dc625
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1280312
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1280312 Sample: SecuriteInfo.com.Win32.Troj... Startdate: 26/07/2023 Architecture: WINDOWS Score: 60 36 Antivirus / Scanner detection for submitted sample 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 Machine Learning detection for sample 2->40 8 loaddll32.exe 1 2->8         started        10 kgplueaj.exe 2->10         started        12 kgplueaj.exe 2->12         started        process3 process4 14 cmd.exe 1 8->14         started        16 rundll32.exe 1 2 8->16         started        19 rundll32.exe 8->19         started        21 5 other processes 8->21 file5 23 rundll32.exe 14->23         started        32 C:\Users\user\AppData\...\kgplueaj.exe, PE32 16->32 dropped 25 WerFault.exe 25 10 16->25         started        27 WerFault.exe 9 19->27         started        process6 process7 29 WerFault.exe 4 9 23->29         started        dnsIp8 34 192.168.2.1 unknown unknown 29->34
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba52afc3af14ee1c1310b78749df19e172aa004d356a8d974a6a00e7c9edf367/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-07-26 11:23:47 UTC
File Type:
PE (Dll)
AV detection:
18 of 23 (78.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xjjk7q5pctxbyeyqw6dutxyz4fzkuacngvvi3f2kniaopspn6ntq._file
Verdict:
unknown
Similar samples:
30b3a610d92484107f21e5bc28f32d008decb661e8044bb782737ace569ac70b
37f3dc0db96f235594f3e2153e851add6103e86a79b81722a130c592d1981f0a
38dc7554359b82417ee81851f0bd42f9661cd4d4b70a648ae8a8cdf1e0b50b37
39ae0f728fa70f88393c1ff6e71502e300ef4197a5214b2cc99d42bb2683ba90
41a6b66b34474558a055b445266241047c38240b85fbf399be40e8841f742d83
9e7731d5cbdd2e9f9c3add54e43eda6a82d782288bf5e9f5a9388affb772e3e3
a99019e3753a7babc2108dc67c77be0d5914b23051b1fd7a07f2b3a3ba840559
ce1ed6c75e5261ea509a09cf2cbb4eca2a28f9ac4bd40d0ede711608233546da
de57a6cd3f2dfb6b6de94dc37869f25974279719c50998ae11cb067606e1e04a
f7537939cb6791cf3b5919514a93bab3a03c8b1d4291817206543902ee63f81a
+ 2'312 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/230726-s1b6nsec5w/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Unpacked files
SH256 hash:
ba52afc3af14ee1c1310b78749df19e172aa004d356a8d974a6a00e7c9edf367
MD5 hash:
45d4118084ecd3a0b0d1d774975dea26
SHA1 hash:
b3bb7761bf51d2ae00733bb1d609ba153743d4eb
Link:
https://www.unpac.me/results/4fdf1e36-f514-410f-94c4-a65fcd5efe01/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/ba52afc3af14ee1c1310b78749df19e172aa004d356a8d974a6a00e7c9edf367

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/434122/

Comments