MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c056211b404b7fca81ed1ab8b796cf3f67f4ea63d9bb14c121a0f9a169348fb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c056211b404b7fca81ed1ab8b796cf3f67f4ea63d9bb14c121a0f9a169348fb7
SHA3-384 hash: 1b2da7ead978498235a6b1a0fa1404098333814158fd7c74c8a03c0eca92053eff31e04b0a71e9b3489b7c140edaa9ab
SHA1 hash: d0f1cfe25a32870e4ea447edecc727acbaaac83c
MD5 hash: f28cf277f04faea18d11dfd62d46090e
humanhash: batman-carbon-pasta-romeo
File name:f28cf277f04faea18d11dfd62d46090e.exe
Download: download sample
File size:1'744'384 bytes
First seen:2024-08-07 06:50:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 49152:WQ0l3YaoP7jBnSuSPDFsmlUdgc3nCQ6Nt7+:WLl3opSuYRsmlwB
TLSH T1798512835A687B27D24E42BAE1E45748C7B1C507A78FE78E7C9868F01D43762ED4422F
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
342
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f28cf277f04faea18d11dfd62d46090e.exe
Verdict:
Malicious activity
Analysis date:
2024-08-07 07:14:37 UTC
Tags:
netreactor crypto-regex
Link:
https://app.any.run/tasks/0e7756d7-f60a-4316-a219-3023f7042ff3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.8264.27300.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66b3195baa5b40be0a9fbace
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Сreating synchronization primitives
Creating a window
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/66b31959e7dbbbdfcd0a3776/reports/0d14d31c-f077-4aa6-8443-5c9f3217b822/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/c056211b404b7fca81ed1ab8b796cf3f67f4ea63d9bb14c121a0f9a169348fb7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/87f432f3-e61b-41cc-bc09-d3375107ec30
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1489291
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c056211b404b7fca81ed1ab8b796cf3f67f4ea63d9bb14c121a0f9a169348fb7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c056211b404b7fca81ed1ab8b796cf3f67f4ea63d9bb14c121a0f9a169348fb7/
Threat name:
Win32.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2024-08-07 09:42:32 UTC
AV detection:
17 of 30 (56.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yblccg2ajn74vapndk4lpfwph5t7j2td3g5rjqjbud42c2jur63q._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/240807-hmjngsxbre/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2396fc27-3ce5-4975-a630-a5167285c1bd
Unpacked files
SH256 hash:
e18b5bb899ddb8d9859e2ccc4a7fbef59583ad7d38d2240867f7fa98b7418ce4
MD5 hash:
257b032a9c4e021d9f0530c9ad0c762d
SHA1 hash:
765e94aac8b834f3d0c86f9ad0e93b9d368e63f6
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/f07a840b-0fd9-4e24-bdea-1539deb66bfe/
SH256 hash:
05bbf2a0469a4a6191aed942efb602864955ba456df4658e2e7bb3e6e9fe795b
MD5 hash:
f2949b5525ff684501e7bd9090bb9e0a
SHA1 hash:
71a1383b5139a076249c364ca85696b5733eeab7
Link:
https://www.unpac.me/results/f07a840b-0fd9-4e24-bdea-1539deb66bfe/
SH256 hash:
d51fff3aa2b5aaa16b185143cc51293eb774ba131d8435170cfae96117d41e97
MD5 hash:
b82b4a4c09dc237ef81996b92e905a9e
SHA1 hash:
f8b8bb849a526e0920d8fe0c39b335022aa33210
Link:
https://www.unpac.me/results/f07a840b-0fd9-4e24-bdea-1539deb66bfe/
SH256 hash:
64a553679789a27d6089cb6e2c3f228f8ffde0a7b2ce1152b3b26fdd3c2b3de3
MD5 hash:
d333299bd5e8e3be283ae35ec5c7bf76
SHA1 hash:
e2601fa8cce8397cb07859d42de54dd7eacaace2
Link:
https://www.unpac.me/results/f07a840b-0fd9-4e24-bdea-1539deb66bfe/
SH256 hash:
19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372
MD5 hash:
4e29f75c0c51b9dec76955f0382d9541
SHA1 hash:
4899aa8e3f57339cbaec8faab777897a76fe1c3a
Link:
https://www.unpac.me/results/f07a840b-0fd9-4e24-bdea-1539deb66bfe/
SH256 hash:
78f73e1734daa918b253517c75971fbb8df773a3d77d02a752e9a0ad1711a677
MD5 hash:
f9d2985aa1c41cca281321fffb5ed424
SHA1 hash:
3a7a58d2dcae2762882357ae34d372744b1dbb9d
Link:
https://www.unpac.me/results/f07a840b-0fd9-4e24-bdea-1539deb66bfe/
SH256 hash:
20f20f3c460ca358fa20e85f5b0804c4cb31b98baafc4819c46e640c9012180a
MD5 hash:
8147dd7ac8944cb1d521a48210b77504
SHA1 hash:
8a18215539ee59b04b4a58c0e663f16708e52abc
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/f07a840b-0fd9-4e24-bdea-1539deb66bfe/
SH256 hash:
c056211b404b7fca81ed1ab8b796cf3f67f4ea63d9bb14c121a0f9a169348fb7
MD5 hash:
f28cf277f04faea18d11dfd62d46090e
SHA1 hash:
d0f1cfe25a32870e4ea447edecc727acbaaac83c
Detections:
SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/f07a840b-0fd9-4e24-bdea-1539deb66bfe/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c056211b404b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c056211b404b7fca81ed1ab8b796cf3f67f4ea63d9bb14c121a0f9a169348fb7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe c056211b404b7fca81ed1ab8b796cf3f67f4ea63d9bb14c121a0f9a169348fb7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3090795/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3090806/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments