MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c275c00ed3831518a88e99ffae3737126da1dd4ef018028850e9b742263e98d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Hive


Vendor detections: 6


Intelligence 6 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c275c00ed3831518a88e99ffae3737126da1dd4ef018028850e9b742263e98d9
SHA3-384 hash: 098197ea38394f359c24577270d3c74f6951554c2cd941e54ee74cde1d4f40f825af0e8c026ff4bf79a3a729dd49d292
SHA1 hash: 4736630e9e0b4649b62abcf93faa8a533cf1d3d6
MD5 hash: 5d17c483194e0fbf2f197995cf84eb6f
humanhash: ceiling-yankee-eleven-beryllium
File name:64770112.exe
Download: download sample
Signature Hive
Create hunting rule
File size:2'731'008 bytes
First seen:2022-03-23 04:45:56 UTC
Last seen:2022-03-23 07:11:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9aebf3da4677af9275c461261e5abde3 (25 x YTStealer, 12 x CobaltStrike, 11 x Hive)
ssdeep 49152:Wk0KRXc3m0RFlcFqM1E40QAjG+f0NVzNNf3yRGIqoBSojOSob22lM8GZaKa:WknRXgm0RjMRCUAj/f0NV3f0GjDL0MzA
Threatray 72 similar samples on MalwareBazaar
TLSH T132C533BE325B5414C13897FBA62EE852151B45F6F2C87D466BE938C20072FE73A31276
Reporter adm1n_usa32
Tags:exe Hive

Intelligence

File Origin
# of uploads :
2
# of downloads :
237
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/255280/
Detection(s):
SecuriteInfo.com.W64.Agent.EBR.genEldorado.17093.15583.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug packed
Link:
https://www.filescan.io/uploads/623aa62ab94fb38cb4d5eb70/reports/9f0cf817-fd43-4938-9da8-c0a5f0e89226/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e165734c-976e-4e06-8704-219a900b5996
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/962377
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c275c00ed3831518a88e99ffae3737126da1dd4ef018028850e9b742263e98d9/
Threat name:
Win64.Infostealer.BroPass
Create hunting rule
Status:
Malicious
First seen:
2022-03-23 04:46:15 UTC
File Type:
PE+ (Exe)
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yj24adwtqmkrrkeoth724nzxcjw2dxko6amafccq5g3uejr6tdmq._file
Verdict:
unknown
Similar samples:
1d954347b4549a195aebc8a176ea7f1140c902bd3f8fddaba2099d8a6f86a216
Hive
1e061432a06c9e4935cd837118e5d68d79ec6c6bbdddcc40d8682e50db7344fa
Hive
29013124da3e662c2662e856b7ef9527fb367ecd1be8aaba412eeb8a6d738a6c
Hive
2c7e8a9b546f7c133469fabcfc200e5ab79da84ffa180fda9e088bc5476af860
Hive
44da6217702a77c01ed9735e67d6fffee11de2298aaaea899ddbc39da26460e0
Hive
973549247e54570bae7013e0346274e5afefef1d7bf2dae489c7c32e210df67c
Hive
9e719c4dd5e1086d5197fded7b8cdb0d3d592c0636b0d469fcda22c9723e8e7c
Hive
ca0abe0d1554af3cbfcf5ee2a0dd00820a0dcb7397ea7add4c2c5334baac9086
Hive
+ 62 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/220323-fdzl8sbhap/
Unpacked files
SH256 hash:
c275c00ed3831518a88e99ffae3737126da1dd4ef018028850e9b742263e98d9
MD5 hash:
5d17c483194e0fbf2f197995cf84eb6f
SHA1 hash:
4736630e9e0b4649b62abcf93faa8a533cf1d3d6
Link:
https://www.unpac.me/results/f8528c86-9757-4f66-96be-bf18bac54912/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c275c00ed3831518a88e99ffae3737126da1dd4ef018028850e9b742263e98d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:methodology_golang_build_strings
Create hunting rule
Author:smiller
Description:Looks for PEs with a Golang build ID

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/255280/

Comments