MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be69a27ea4cea45c49e75a0eb57cd503190d08eb97184c492c084a822e29374e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Hive


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be69a27ea4cea45c49e75a0eb57cd503190d08eb97184c492c084a822e29374e
SHA3-384 hash: d3f6872974f83ab0d43c0001b4ffad94413d0da459ba23e4cbadcf671574196ed3adcf2e9cb0e3a14c1e02280ccb2050
SHA1 hash: 3a46e9bde11e73ea4abf37bfa74dd4b8a69f9f99
MD5 hash: 3a86dfb61e88934736ec1807338c7bd3
humanhash: network-uncle-louisiana-montana
File name:3a86dfb61e88934736ec1807338c7bd3
Download: download sample
Signature Hive
Create hunting rule
File size:5'681'152 bytes
First seen:2022-07-04 10:03:07 UTC
Last seen:2022-07-04 11:16:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ef5ee1a30d4a83fd2256bd92297da50a (7 x Hive, 1 x RedLineStealer, 1 x 000Stealer)
ssdeep 49152:6tSHkCyvh0uhRLTxd+K7EIrbgGCpLXadU/8IrOZHZVRcfM62d7EpQW/61jn+E0tE:65veub/x6ebgGCpLXSRZ05sx97Du
TLSH T106464B90F9DB84F2EA03557004A762AF23306E0A4B39DEC7D6407F6AFCB66E10977525
gimphash b85fba3ca3375a0eca27df48a172127e99cd708fac23df86d74c29fb5cb344ca
TrID 37.2% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
27.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
14.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
5.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter zbetcheckin
Tags:32 exe Hive

Intelligence

File Origin
# of uploads :
2
# of downloads :
342
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.17736.18290.2540.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Reading critical registry keys
Using the Windows Management Instrumentation requests
Stealing user critical data
Sending a TCP request to an infection source
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug barys wacatac
Link:
https://www.filescan.io/uploads/62c2bb50dd037e27032e86bf/reports/5e8bbc00-cf66-4727-a744-f971365ccca9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CoinMiner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d88caf26-4b9a-4ce9-80e5-bafcc1aa6c26
Result
Threat name:
000Stealer, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1024066
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Xmrig
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected 000Stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 656559 Sample: qqxQsO9ogW Startdate: 04/07/2022 Architecture: WINDOWS Score: 100 68 Snort IDS alert for network traffic 2->68 70 Sigma detected: Xmrig 2->70 72 Antivirus detection for URL or domain 2->72 74 6 other signatures 2->74 12 qqxQsO9ogW.exe 2 2->12         started        17 UGBOMITO.exe 2->17         started        19 UGBOMITO.exe 2->19         started        21 UGBOMITO.exe 2->21         started        process3 dnsIp4 64 185.112.83.111, 49761, 49762, 49763 SUPERSERVERSDATACENTERRU Russian Federation 12->64 58 C:\Users\user\AppData\Local\Temp\rat.exe, PE32 12->58 dropped 96 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 12->96 98 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 12->98 100 Tries to harvest and steal ftp login credentials 12->100 102 3 other signatures 12->102 23 rundll32.exe 1 12->23         started        file5 signatures6 process7 process8 25 rat.exe 3 23->25         started        file9 56 C:\Users\user\...\DNMMQNNNPxACWOZPXDdd.exe, PE32 25->56 dropped 84 Antivirus detection for dropped file 25->84 86 Multi AV Scanner detection for dropped file 25->86 88 Detected unpacking (changes PE section rights) 25->88 90 2 other signatures 25->90 29 DNMMQNNNPxACWOZPXDdd.exe 5 25->29         started        signatures10 process11 file12 60 C:\ProgramData\vhjvjhjbgjg\UGBOMITO.exe, PE32 29->60 dropped 104 Antivirus detection for dropped file 29->104 106 Multi AV Scanner detection for dropped file 29->106 108 Detected unpacking (changes PE section rights) 29->108 110 2 other signatures 29->110 33 cmd.exe 1 29->33         started        signatures13 process14 signatures15 66 Uses schtasks.exe or at.exe to add and modify task schedules 33->66 36 UGBOMITO.exe 15 5 33->36         started        41 conhost.exe 33->41         started        43 timeout.exe 1 33->43         started        process16 dnsIp17 62 microsoftvisualstudio.wtf 185.105.110.4, 49788, 49790, 80 VDSINA-ASRU Russian Federation 36->62 54 C:\ProgramData\vhjvjhjbgjg\ton.exe, PE32+ 36->54 dropped 76 Antivirus detection for dropped file 36->76 78 Multi AV Scanner detection for dropped file 36->78 80 Detected unpacking (changes PE section rights) 36->80 82 3 other signatures 36->82 45 ton.exe 36->45         started        48 cmd.exe 1 36->48         started        file18 signatures19 process20 signatures21 92 Multi AV Scanner detection for dropped file 45->92 94 Machine Learning detection for dropped file 45->94 50 conhost.exe 48->50         started        52 schtasks.exe 1 48->52         started        process22
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be69a27ea4cea45c49e75a0eb57cd503190d08eb97184c492c084a822e29374e/
Threat name:
Win32.Trojan.Barys
Create hunting rule
Status:
Malicious
First seen:
2022-07-01 17:19:40 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xzu2e7vez2sfysphlihlk7gvammq2chls4meysjmbbfielrjg5ha._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence spyware stealer
Link:
https://tria.ge/reports/220704-l3xf3agcgk/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Unpacked files
SH256 hash:
be69a27ea4cea45c49e75a0eb57cd503190d08eb97184c492c084a822e29374e
MD5 hash:
3a86dfb61e88934736ec1807338c7bd3
SHA1 hash:
3a46e9bde11e73ea4abf37bfa74dd4b8a69f9f99
Link:
https://www.unpac.me/results/70a8cd93-b745-4096-9079-b1e369f0af84/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/be69a27ea4ce/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Hive

Executable exe be69a27ea4cea45c49e75a0eb57cd503190d08eb97184c492c084a822e29374e

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2253745/

Comments


Avatar
zbet commented on 2022-07-04 10:03:10 UTC

url : hxxp://185.112.83.111/fik.exe