MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfaf95fc7c62311c327097888ee85ae1979ba74ea93090368977674c420516d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bfaf95fc7c62311c327097888ee85ae1979ba74ea93090368977674c420516d8
SHA3-384 hash:	a8c20ff0e266ec0c8f03f0dda04c172c17eb127873db21349d5716bf58e9b23f2762f8edbd479c226cefadbc1811a0ca
SHA1 hash:	d984aee223e3939a337e88ba8ae91db5a85539be
MD5 hash:	c5f8c4c788e5609886255ebb98005ef4
humanhash:	florida-magnesium-ten-helium
File name:	rRFQ4200320466_pdf.exe
Download:	download sample
Signature	CustomerLoader Alert Create hunting rule
File size:	55'808 bytes
First seen:	2023-07-18 12:58:59 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	768:WlnUOicO+ML3M2F7Tllmu24Ra2DovIieNhIPVQPan8MF17TxfHIIIFPg:X+Mw2JTll92m7ov0oWvk7TxfHIIIFPg
TLSH	T197438D0827AEC15AE1A606B4CC51C3F127F92E572D97EF1BABC87E4B7C07640BA06165
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	c4d48eaa8ad4d4f8 (1'000 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm)
Reporter	FXOLabs
Tags:	CustomerLoader exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

264

Origin country :

BR

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

rRFQ4200320466_pdf.exe

Verdict:

No threats detected

Analysis date:

2023-07-18 12:59:30 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/89e5d262-9854-4f27-b927-be204aeafa88

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/423514/

ClamAV Detected

Detection(s):

Porcupine.Trojan.MSIL.Bsymem.gen.150251.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Sending a custom TCP request

Query of malicious DNS domain

Sending a TCP request to an infection source

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/64b68c98fd9e198dc11585a1/reports/79cfb610-86c4-40da-bbeb-521302517c17/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/bfaf95fc7c62311c327097888ee85ae1979ba74ea93090368977674c420516d8

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/23f72247-7ffc-4255-ae29-a9675220ee4d

Joe Sandbox Customer Loader

Result

Threat name:

Customer Loader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1275308

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected Costura Assembly Loader

Yara detected Customer Loader

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bfaf95fc7c62311c327097888ee85ae1979ba74ea93090368977674c420516d8/

ReversingLabs TitaniumCloud Win64.Trojan.Leonem

Threat name:

Win64.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-18 12:20:58 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

10

AV detection:

20 of 37 (54.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x6xzl7d4miyrymtqs6ei52c24glzxj2oveyjanujo5tuyqqfc3ma._file

Threatray unknown

Verdict:

unknown

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/230718-p73enabb8s/

Behaviour

Suspicious use of AdjustPrivilegeToken

UnpacMe

Unpacked files

SH256 hash:

bfaf95fc7c62311c327097888ee85ae1979ba74ea93090368977674c420516d8

MD5 hash:

c5f8c4c788e5609886255ebb98005ef4

SHA1 hash:

d984aee223e3939a337e88ba8ae91db5a85539be

Link:

https://www.unpac.me/results/b022f22f-362b-4553-b0f0-450f2ebdb99d/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bfaf95fc7c62311c327097888ee85ae1979ba74ea93090368977674c420516d8

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

CustomerLoader

exe bfaf95fc7c62311c327097888ee85ae1979ba74ea93090368977674c420516d8

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/423514/