MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be704f3e18c83ab1bb44984e616784bb411f937ce131d70249b959479d89b94b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Nitol

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments 1

SHA256 hash:	be704f3e18c83ab1bb44984e616784bb411f937ce131d70249b959479d89b94b
SHA3-384 hash:	9a50176b3fdbeb5cc37d44101c6aafe1e66fd24f69763a0f00a72d24df3a19a0da60d5b0e1d3c44ab637252047279c44
SHA1 hash:	2971426ec9564ed42b2775aff43717d71e7cea8e
MD5 hash:	72dceacc4ca915d4704e2e612d590ac3
humanhash:	two-bacon-purple-arizona
File name:	72dceacc4ca915d4704e2e612d590ac3
Download:	download sample
Signature	Nitol Create hunting rule
File size:	225'280 bytes
First seen:	2022-07-19 19:29:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8513d38276d3bae5f771a5f33a9b91c2 (3 x Nitol)
ssdeep	3072:0+Ii7CwTmEjamOyWMZ13UE5qBqg4Psb0fW68/0npV2owr73sOoKvtJnUkZEPg4Tf:0geYrumOy7Z1kr7Ksb02MnaUMEPb
TLSH	T18D24AE1132E1C0B7E467053149E6C7B877B6BE039F31854FABE03B4D6E711A54A29F62
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	79756cecb29999b9 (734 x Heodo, 20 x Nitol, 20 x ManusCrypt)
Reporter	zbetcheckin
Tags:	32 exe Nitol

Intelligence

File Origin

# of uploads :

# of downloads :

259

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

socelars

ID:

File name:

Setup.exe

Verdict:

Malicious activity

Analysis date:

2022-07-18 01:07:43 UTC

Tags:

evasion trojan socelars stealer opendir loader rat redline ransomware stop miner tofsee

Link:

https://app.any.run/tasks/c2f82c21-a842-4a46-98a2-14f7365a200d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/292013/

Detection(s):

Win.Trojan.Manuscrypt-9956552-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Searching for synchronization primitives

Creating a window

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Creating a file in the %temp% directory

Using the Windows Management Instrumentation requests

Launching a process

Sending a UDP request

Possible injection to a system process

Unauthorized injection to a system process

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/26776/overview

Behaviour

MalwareBazaar

CheckScreenResolution

CPUID_Instruction

SystemUptime

CursorPosition

MeasuringTime

EvasionQueryPerformanceCounter

CheckCmdLine

EvasionGetTickCount

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware keylogger shell32.dll

Link:

https://www.filescan.io/uploads/62d706cb0e298a94f3df735a/reports/1aed468a-a303-40c8-8d55-9c4715a94380/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/eb898bff-c784-41d7-98b3-c9e57954b75a

Result

Threat name:

Nitol

Detection:

malicious

Classification:

bank.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1036800

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to detect sleep reduction / modifications

Contains functionality to infect the boot sector

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Creates processes via WMI

Installs new ROOT certificates

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive service information (via WMI, MSSMBios_RawSMBiosTables, often done to detect sandboxes)

Queries temperature or sensor information (via WMI often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sets a auto configuration URL for Internet Explorer (IE settings are enforced automatically)

Sets debug register (to hijack the execution of another thread)

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected Nitol

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/be704f3e18c83ab1bb44984e616784bb411f937ce131d70249b959479d89b94b/

Threat name:

Win32.Backdoor.Manuscrypt

Status:

Malicious

First seen:

2022-07-16 18:46:18 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xzye6pqyza5ldo2etbhgcz4exnar7e344ey5oasjxfmuphmjxffq._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://tria.ge/reports/220719-x7st8aahck/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies registry class

Modifies system certificate store

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in System32 directory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Loads dropped DLL

Unexpected DNS network traffic destination

Process spawned unexpected child process

Suspicious use of NtCreateUserProcessOtherParentProcess

Unpacked files

SH256 hash:

be704f3e18c83ab1bb44984e616784bb411f937ce131d70249b959479d89b94b

MD5 hash:

72dceacc4ca915d4704e2e612d590ac3

SHA1 hash:

2971426ec9564ed42b2775aff43717d71e7cea8e

Link:

https://www.unpac.me/results/9e1d13aa-c7d8-4eea-b35a-54e153ffc79c/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/be704f3e18c8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/be704f3e18c83ab1bb44984e616784bb411f937ce131d70249b959479d89b94b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.