MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 baa13ad4c9d7ba4f03915385de91c623e63c677a363a1dd2acb2d6f119b8adc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: baa13ad4c9d7ba4f03915385de91c623e63c677a363a1dd2acb2d6f119b8adc4
SHA3-384 hash: a9e5cf8cf79612a7c4fc60a01a9147946c77dc6d7f70b48ccba1a5327c076d80e8b9fd2999c28478c1b11071e8b08dc2
SHA1 hash: 041cce3c1e69f77923154b9f9be9c09a38ae2515
MD5 hash: a4f8a32f1927d1bf93fbc814883063a3
humanhash: california-video-alpha-washington
File name:baa13ad4c9d7ba4f03915385de91c623e63c677a363a1dd2acb2d6f119b8adc4
Download: download sample
File size:1'429'679 bytes
First seen:2024-02-05 15:08:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 319b1edcc4538be377f43066c635ffef (8 x RedLineStealer, 2 x njrat, 2 x 44CaliberStealer)
ssdeep 24576:qxLsMs8WdUS8vyooy7U2H55KnzRfnVQF8IqKLu/9ASfb3vXCFK9pYEm1Ap3U:usldsvyoXfHPKl/9Ij+9bqFK9pDm16E
Threatray 45 similar samples on MalwareBazaar
TLSH T18D6523207FC0D9B1C06244390E95AB796A39FC2017361AC76768BF1D8D355D1BA3EBA3
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter adrian__luca
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
367
Origin country :
HU HU
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/474758/
Detection(s):
Win.Dropper.njRAT-9986242-0
Create hunting rule

Win.Dropper.Nanocore-9986456-0
Create hunting rule

Win.Malware.Bladabindi-10008357-0
Create hunting rule

Win.Packed.Bladabindi-10017056-0
Create hunting rule

Win.Malware.Zenpak-10017873-0
Create hunting rule

Win.Malware.Zusy-10017928-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint lolbin overlay packed setupapi shdocvw shell32
Link:
https://www.filescan.io/uploads/65c0fa14a317adb74262db65/reports/04ce4554-3503-42ff-8ee1-4095cfcfc2b3/overview
Verdict:
Malicious
Labled as:
Fugrafa.Generic
Link:
https://www.hybrid-analysis.com/sample/baa13ad4c9d7ba4f03915385de91c623e63c677a363a1dd2acb2d6f119b8adc4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/64a0120d-0123-4249-a46c-dd0bb6940946
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
39 / 100
Link:
https://www.joesandbox.com/analysis/1386911
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/baa13ad4c9d7ba4f03915385de91c623e63c677a363a1dd2acb2d6f119b8adc4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/baa13ad4c9d7ba4f03915385de91c623e63c677a363a1dd2acb2d6f119b8adc4/
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2024-01-24 23:48:53 UTC
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkqtvvgj265e6a4rkoc55eogeptdyz32gy5b3uvmwllpcgnyvxca._file
Verdict:
malicious
Similar samples:
0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf
1a46e6e32088d0c791249c4499019ad68d13c8de72f2b1a36cb8a5bb46e9c4f2
af0c48ca1ed3431b936d489bf1e8255a5d4182bd6164946bd6179ae3f212d0b1
e64376fdce40bf0d5677f2bc7d28fc37e7f60b95824188e71ec27e27bcec1d77
ef9824bc08faee0f6cfa5ae692a33019ab4a100c55c1bbcab9a1d2c96d274abd
+ 35 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240205-sje61acgdm/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Unpacked files
SH256 hash:
baa13ad4c9d7ba4f03915385de91c623e63c677a363a1dd2acb2d6f119b8adc4
MD5 hash:
a4f8a32f1927d1bf93fbc814883063a3
SHA1 hash:
041cce3c1e69f77923154b9f9be9c09a38ae2515
Link:
https://www.unpac.me/results/4eb385bf-08a6-4972-839c-48220c2a869d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/baa13ad4c9d7ba4f03915385de91c623e63c677a363a1dd2acb2d6f119b8adc4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/474758/

Comments