MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c01ba6fe8a2ff71984acff3f7e7c712bf8a5fe6971285ac2eaaf65246cd276b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Nitol

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	c01ba6fe8a2ff71984acff3f7e7c712bf8a5fe6971285ac2eaaf65246cd276b5
SHA3-384 hash:	87cccd17d0f57efac058dde417e232da4ef0ce07885385171401b8113df53dc13a4fa23e81df3a37586b352f3b138f6a
SHA1 hash:	42024cdf75d5a955e6ce9a54ebb0a0bbff37bd96
MD5 hash:	798cc81df4b17c943e8a21d90beaa5ab
humanhash:	six-pizza-asparagus-lima
File name:	798cc81df4b17c943e8a21d90beaa5ab
Download:	download sample
Signature	Nitol Create hunting rule
File size:	229'376 bytes
First seen:	2022-07-14 04:19:04 UTC
Last seen:	2022-07-15 03:15:26 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	7321795107eff35190fe391b3cc1e113 (5 x Nitol)
ssdeep	3072:gUjUl2b7MXSamAalYfw8BS+MWHbbXdARiBc5Jwr73pdeaDtzk9AUEPg4Tdp:gYeeQXSamASYfgcbbNXcwA9AUEPb
Threatray	411 similar samples on MalwareBazaar
TLSH	T112249D2132D2C073E4A7153149E287B877B6BF52AB32C54FAB903B4E1E706558E35F62
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	79756cecb29999b9 (734 x Heodo, 20 x Nitol, 20 x ManusCrypt)
Reporter	openctibr
Tags:	exe Nitol OpenCTI.BR Sandboxed

Intelligence

File Origin

# of uploads :

# of downloads :

159

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

socelars

ID:

File name:

setup.exe

Verdict:

Malicious activity

Analysis date:

2022-07-12 19:43:44 UTC

Tags:

evasion trojan socelars stealer loader rat redline opendir ransomware stop

Link:

https://app.any.run/tasks/88dc52be-c91c-4414-82d8-beb35812dfb5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/287910/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.39965981.23227.22690.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Searching for synchronization primitives

Creating a window

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Creating a file in the %temp% directory

Using the Windows Management Instrumentation requests

Launching a process

Sending a UDP request

Possible injection to a system process

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware keylogger shell32.dll

Link:

https://www.filescan.io/uploads/62cf99ae22710a35d9e488b8/reports/e3e98d8b-afb0-4513-b662-6062ce771c72/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0610098a-fce2-4253-8fa5-970427e2ffcd

Result

Threat name:

Nitol

Detection:

malicious

Classification:

bank.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1032082

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

Creates a thread in another existing process (thread injection)

Creates processes via WMI

Installs new ROOT certificates

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sets a auto configuration URL for Internet Explorer (IE settings are enforced automatically)

Sets debug register (to hijack the execution of another thread)

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected Nitol

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c01ba6fe8a2ff71984acff3f7e7c712bf8a5fe6971285ac2eaaf65246cd276b5/

Threat name:

Win32.Backdoor.Manuscrypt

Status:

Malicious

First seen:

2022-07-09 20:57:35 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 26 (61.54%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yan2n7ukf73rtbfm747x47drfp4kl7tjoeufvqxkv5ssi3gso22q._file

Verdict:

malicious

Nitol

0af3be1d14de7a46515369b5f8e57121ccf6c54f731b1e6bf79fe6306c173f2e

Nitol

7c3642c12a6b550058c554c47278704471042257f62b6a677a78f387e74e91e8

Nitol

868bb2b1387c06898cc942fc7a2858a19c907622379e9705eeed3591c488cdb9

Nitol

ae2575bbb41d61f5f82e924019a4ae672ed12c914f9b82c131a1ca4b74c3d873

Nitol

b9ba3633e6ae613c553bb7311affb973b5d3c5f41de5a9e5f1b048cb2cda8a34

Nitol

cf6fa87eaaacb5cd4c27921185d8c5a00488f36c2b549957f1049d064283b48b

Nitol

d083094f008a2e68de555a67105f3d6d82605f4af5d52700e171c833f6da10a1

Nitol

+ 401 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

suricata

Link:

https://tria.ge/reports/220714-exmaksgbb4/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies registry class

Modifies system certificate store

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in System32 directory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Loads dropped DLL

Unexpected DNS network traffic destination

Process spawned unexpected child process

Suspicious use of NtCreateUserProcessOtherParentProcess

suricata: ET MALWARE ClipBanker Variant Activity (POST)

Unpacked files

SH256 hash:

c01ba6fe8a2ff71984acff3f7e7c712bf8a5fe6971285ac2eaaf65246cd276b5

MD5 hash:

798cc81df4b17c943e8a21d90beaa5ab

SHA1 hash:

42024cdf75d5a955e6ce9a54ebb0a0bbff37bd96

Link:

https://www.unpac.me/results/5b1050fa-6845-40fb-a2d8-b0f44d65c9f7/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c01ba6fe8a2f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c01ba6fe8a2ff71984acff3f7e7c712bf8a5fe6971285ac2eaaf65246cd276b5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.