MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2cfc4d5c64386b50cef4a2a7baa4c24546109ac097845bbc9474b4ad0f19108. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Ousaban

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	c2cfc4d5c64386b50cef4a2a7baa4c24546109ac097845bbc9474b4ad0f19108
SHA3-384 hash:	6e764da37693787ce97610a7199824b06ac82c56d13f805066c5b3ad6271d759e5091772ae42691ec6fdd510843d031a
SHA1 hash:	e1774eb49503e57c5fb7b9ed7cb237d12743ab74
MD5 hash:	784660649f5fbfec6c7e22e6d479eed8
humanhash:	oxygen-edward-carbon-earth
File name:	info20219304BR.VXWAYJHUUOUYLLXJYSPZUMKLBPCZMP_.msi
Download:	download sample
Signature	Ousaban Create hunting rule
File size:	288'768 bytes
First seen:	2021-08-04 12:46:04 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	3072:n3ygYXkj7q0vTYDryO1nbrU6ij4qpXqnnDibAJBVkF9nY5A+3DXLAcDXDCz:n5i/rTqp4nwEOY5A+3DXLzz
Threatray	3'357 similar samples on MalwareBazaar
TLSH	T108548D0573C78637EADF07326F479362DAB2BC248552C11742997A4E2CF514AE2B3BE1
Reporter	warz_s
Tags:	Banload brazil dropper msi ousaban

Intelligence

File Origin

# of uploads :

# of downloads :

1'304

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/176325/

Detection(s):

SecuriteInfo.com.Trojan-Spy.Agent.22897.UNOFFICIAL

SecuriteInfo.com.JS.Obfus-1914.UNOFFICIAL

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/c2cfc4d5c64386b50cef4a2a7baa4c24546109ac097845bbc9474b4ad0f19108

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/826841

Signature

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c2cfc4d5c64386b50cef4a2a7baa4c24546109ac097845bbc9474b4ad0f19108/

Threat name:

Script-JS.Trojan.Heuristic

Status:

Malicious

First seen:

2021-08-04 12:47:04 UTC

AV detection:

6 of 28 (21.43%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ylh4jvogiodlkdhpjivhxksmerkgccnmbf4elo6ji5fuvuhrseea._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

9/10

Tags:

bootkit evasion macro persistence themida trojan xlm

Link:

https://tria.ge/reports/210804-zsmnk8bb2s/

Behaviour

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Windows directory

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Adds Run key to start application

Checks whether UAC is enabled

Enumerates connected drives

Looks up external IP address via web service

Writes to the Master Boot Record (MBR)

Checks BIOS information in registry

Drops startup file

Loads dropped DLL

Themida packer

Blocklisted process makes network request

Executes dropped EXE

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/c2cfc4d5c64386b50cef4a2a7baa4c24546109ac097845bbc9474b4ad0f19108

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.