MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0f964f8f96bcba4be2939d74fca291d537801737cdde729b9cc9c3aca2a16b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0f964f8f96bcba4be2939d74fca291d537801737cdde729b9cc9c3aca2a16b7
SHA3-384 hash: 2bca8702a108c759adb256d80173d836106380dbcd492e8f49b6c68758ea67dc6bc11d8173c78d1db71b180e25430610
SHA1 hash: 60abc8c92aab1b431183db265575f074ae863378
MD5 hash: 6435f7fe410afb11ad58885eeb93b23c
humanhash: hamper-six-early-montana
File name:file
Download: download sample
File size:679'936 bytes
First seen:2022-09-16 06:14:25 UTC
Last seen:2022-09-16 06:31:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fa00c14e8058bd23fb45fe5e1dc24e84 (1 x RedLineStealer)
ssdeep 6144:1BYbaoykQEKFhXGonXVfmBFm7g0CzrPdhylku3fOzcVBXJMiehO:1ibJbQEKFhXBnVmmg0Cdhyu0JKE
TLSH T15BE46B301F381ECCC05B59F79C96F2A48AF295797F91F4E3A47652BD8A06AA43F20351
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:exe


Avatar
andretavare5
Sample downloaded from https://labolaget.gr/12/TrdngAnlzr479112.exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
312
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Suspicious activity
Analysis date:
2022-09-16 06:26:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/571f21d0-3442-4b71-83ab-a7f70cf7d293

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/310434/
Detection(s):
SecuriteInfo.com.Win64.Trojan-gen.19131.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Creating a file in the system32 subdirectories
Creating a file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/37813/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/632414e11183046074a62482/reports/7355d2e4-0ea0-4c37-9a93-33cb7433f9bb/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6cc0c892-1cda-419d-87e7-b5985d5a97e6
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1071408
Signature
Contains functionality to inject code into remote processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 703950 Sample: file.exe Startdate: 16/09/2022 Architecture: WINDOWS Score: 56 16 Multi AV Scanner detection for submitted file 2->16 18 Machine Learning detection for sample 2->18 6 file.exe 2->6         started        process3 signatures4 20 Contains functionality to inject code into remote processes 6->20 9 WerFault.exe 23 9 6->9         started        12 file.exe 6->12         started        process5 file6 14 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 9->14 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0f964f8f96bcba4be2939d74fca291d537801737cdde729b9cc9c3aca2a16b7/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-09-16 06:15:10 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yd4wj6hznpf2jprjhhlu7srjdvjxqaltpto6oknzzsodvsrkc23q._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220916-gzxv7saegj/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/00453d79-8bcd-4907-94fe-08f43b7108fe
Unpacked files
SH256 hash:
5aff8630fbdac651a4026cf56124de138e88370bb831d2adc534008fa762d6a1
MD5 hash:
630354740642a098d6e1f58988134ac0
SHA1 hash:
0736b320d14b2ee9c12a41c5cca69208e2d4a115
Link:
https://www.unpac.me/results/79d179a7-37fd-4116-a937-c7ea4181b7b4/
SH256 hash:
c0f964f8f96bcba4be2939d74fca291d537801737cdde729b9cc9c3aca2a16b7
MD5 hash:
6435f7fe410afb11ad58885eeb93b23c
SHA1 hash:
60abc8c92aab1b431183db265575f074ae863378
Link:
https://www.unpac.me/results/79d179a7-37fd-4116-a937-c7ea4181b7b4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c0f964f8f96b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c0f964f8f96bcba4be2939d74fca291d537801737cdde729b9cc9c3aca2a16b7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/310434/
  
URLhaus
https://urlhaus.abuse.ch/url/2304859/

Comments