MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c14b0b8755871a595d9e9ae5aaa00dfc611a36b6198d5703b38c535e31688675. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Lucifer


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c14b0b8755871a595d9e9ae5aaa00dfc611a36b6198d5703b38c535e31688675
SHA3-384 hash: 9d73016a38c2701d7fc57f95e0ddcabc38a70c99459cb31752a9c076096f830dea1409b484df5d411b32181aa3555ad0
SHA1 hash: db4abdac8b588f25f5abf36a331a9014ac13f3b0
MD5 hash: d2a6fe3fc2dcd1b47d9420e71d5d3ba6
humanhash: nebraska-five-eight-neptune
File name:d2a6fe3fc2dcd1b47d9420e71d5d3ba6.exe
Download: download sample
Signature Lucifer
Create hunting rule
File size:1'051'648 bytes
First seen:2022-06-11 12:30:54 UTC
Last seen:2022-06-11 15:41:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:fRkZb7aspBUFjLz4RQtVNCcuM2WAjp0SqXDmj98zg:gblBUxz4K73QWAjprqXDu98z
Threatray 1'428 similar samples on MalwareBazaar
TLSH T10625121A7A05E94EC0168633C5DA281053B2AE87172BE74F64C7339D8A1B7DFCE191DB
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe Lucifer

Intelligence

File Origin
# of uploads :
3
# of downloads :
301
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fbea88b9e89f7e66a554a96115a0fd37d0126d8d3cd6d1978421f5b88f291475.xlsx
Verdict:
Malicious activity
Analysis date:
2022-06-11 04:56:15 UTC
Tags:
encrypted opendir exploit CVE-2017-11882 loader evasion
Link:
https://app.any.run/tasks/5c8bcb6b-8479-4229-be1b-e6cd913148ed

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/278896/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Basic.6.Gen.28620.2581.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Moving of the original file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62a48b254d1ff31e31b6c05e/reports/3294dd11-6359-451d-ac62-6739a4444789/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/692eb182-ee90-403d-a78a-6b038ded387f
Result
Threat name:
Predator
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1011345
Signature
Antivirus detection for URL or domain
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Predator
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 643839 Sample: Bm6U0Vj6pa.exe Startdate: 11/06/2022 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Antivirus detection for URL or domain 2->52 54 6 other signatures 2->54 7 Bm6U0Vj6pa.exe 3 2->7         started        11 update_221103.exe 3 2->11         started        13 update_221103.exe 2 2->13         started        process3 file4 34 C:\Users\user\AppData\...\Bm6U0Vj6pa.exe.log, ASCII 7->34 dropped 56 May check the online IP address of the machine 7->56 58 Injects a PE file into a foreign processes 7->58 15 Bm6U0Vj6pa.exe 16 19 7->15         started        20 update_221103.exe 11->20         started        22 update_221103.exe 13->22         started        signatures5 process6 dnsIp7 38 ip-api.com 208.95.112.1, 49741, 49745, 49754 TUT-ASUS United States 15->38 40 hamzaunesi.info 193.243.189.45, 49758, 49759, 49762 ASN-KYOCERAEUDE Germany 15->40 42 192.168.2.1 unknown unknown 15->42 28 C:\Users\user\AppData\Local\Temp\Zip.exe, PE32 15->28 dropped 30 C:\Users\user\Desktop30ewtonsoft.Json.dll, PE32 15->30 dropped 32 C:\Users\user\AppData\...32ewtonsoft.Json.dll, PE32 15->32 dropped 44 Moves itself to temp directory 15->44 46 Tries to harvest and steal browser information (history, passwords, etc) 15->46 24 Zip.exe 14 4 15->24         started        file8 signatures9 process10 dnsIp11 36 ip-api.com 24->36 60 Multi AV Scanner detection for dropped file 24->60 62 Detected unpacking (overwrites its own PE header) 24->62 64 May check the online IP address of the machine 24->64 66 Machine Learning detection for dropped file 24->66 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c14b0b8755871a595d9e9ae5aaa00dfc611a36b6198d5703b38c535e31688675/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2022-06-10 15:49:47 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
11 of 41 (26.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yffqxb2vq4nfsxm6tls2vian7rqrunvwdggvoa5trrjv4mliqz2q._file
Verdict:
malicious
Similar samples:
5ad68e0938866ceb07515ecee72f0677459db9ac6c3286e7f435d0b26d1afc51
Lucifer
b72e48f5e44ac62ff8a6946d030f1d156d0ecd2c6f6a38e42df69b1290d7fd7e
Lucifer
e2716a711f6bb22d2ff77e0da881b24d16b554bc081b6a7d11d23027d4a47670
Lucifer
f62eb2c218ce5b7958aa7fcd2aa5c604fcc571e10bb4c373bb396d9e85733e44
Lucifer
+ 1'418 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
collection discovery persistence spyware stealer suricata
Link:
https://tria.ge/reports/220611-pp2qeaecfl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
suricata: ET MALWARE Generic gate .php GET with minimal headers
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2
Unpacked files
SH256 hash:
a675f303f6e1ed214cb7ae9910246a1d54565da05690b29001d713f2acaad961
MD5 hash:
feed7bf03a05e5d55c945349f4db4399
SHA1 hash:
19021308efc63f8063b7d9b805b2a75ba18b3833
Link:
https://www.unpac.me/results/5f989dcf-0738-44a3-966d-57f3dc197df2/
SH256 hash:
bf78263914c6d3f84f825504536338fadd15868d788bf30d30613ca27abeb7a9
MD5 hash:
3afd64484a2a34fc34d1155747dd3847
SHA1 hash:
451e1d878179f6fcfbaf9fa79d9ee8207489748f
Link:
https://www.unpac.me/results/5f989dcf-0738-44a3-966d-57f3dc197df2/
SH256 hash:
ac339deed84cafab79d2a4bc7b232849a0232b2664dbd56c12b5c90e90a91c32
MD5 hash:
f532e03f70df6dd099be185f501d9fe0
SHA1 hash:
a637e7559d9e4963b74ce29bdf30dc4632e574f2
Link:
https://www.unpac.me/results/5f989dcf-0738-44a3-966d-57f3dc197df2/
SH256 hash:
b08c0ec7a0edc5b6ad3db47df05f2f35e5275e8aabcd81fc1e58e4ef33c6e726
MD5 hash:
e9697dd227542029afc09f1532b5b96c
SHA1 hash:
b6a3b53a3b829a4466b8cf11ba337c97a5bccb2f
Link:
https://www.unpac.me/results/5f989dcf-0738-44a3-966d-57f3dc197df2/
SH256 hash:
bbeaeb64788ddff3adeacda4581d52840b6d93b2e1be2e3466d74077d90fe27e
MD5 hash:
8bd46b65db34c5e0ff6b35a8aeb5bd4c
SHA1 hash:
bea9ac682478b879523e1de424df61b281ba09b1
Link:
https://www.unpac.me/results/5f989dcf-0738-44a3-966d-57f3dc197df2/
SH256 hash:
cf4bf6f7ce83ab5b8bad0ab6166670a9d1a607cb8a825cebbcc1aa3a23537bfb
MD5 hash:
200285b819ede45ea49e8918541ade67
SHA1 hash:
fec8d54f8a372986d3c77bbe37a945ca9614bb01
Link:
https://www.unpac.me/results/5f989dcf-0738-44a3-966d-57f3dc197df2/
SH256 hash:
c14b0b8755871a595d9e9ae5aaa00dfc611a36b6198d5703b38c535e31688675
MD5 hash:
d2a6fe3fc2dcd1b47d9420e71d5d3ba6
SHA1 hash:
db4abdac8b588f25f5abf36a331a9014ac13f3b0
Link:
https://www.unpac.me/results/5f989dcf-0738-44a3-966d-57f3dc197df2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/c14b0b8755871a595d9e9ae5aaa00dfc611a36b6198d5703b38c535e31688675

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Lucifer

Executable exe c14b0b8755871a595d9e9ae5aaa00dfc611a36b6198d5703b38c535e31688675

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2234149/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/278896/

Comments