MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c42aa3048aeb7415fa3fbc93700fef04354aca6f5fe907dd7b86f7858e2a28d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c42aa3048aeb7415fa3fbc93700fef04354aca6f5fe907dd7b86f7858e2a28d3
SHA3-384 hash: af9af8bd9672b272c932cbde69c37f6436cb760a2632f32cd8d0b495ec1aa22fc5a383af2b70c8e01f5b367705429a60
SHA1 hash: 9612d39ff4efcb621e2e0f69abb8dfcd37deb02f
MD5 hash: 866f4c3885ca96d8f41d65b4bbe91612
humanhash: floor-low-queen-spaghetti
File name:SecuriteInfo.com.Trojan.MulDrop21.32565.4564.27113
Download: download sample
File size:1'850'696 bytes
First seen:2024-02-24 20:25:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0198d73a9665a32e37d7bff27b8115e3
ssdeep 49152:18RKp78889tIXaYCxUEETnVnaQ8lMD9EQBUOY:CRq78b92Lu9EVX8ls0OY
TLSH T1E18533D76161987AF0A32BBEC16A6BB1292DFC8594CA1D027257BC1D3C31DDA3781237
TrID 39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6)
38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
7.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.9% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon f8beb2f2d8cc6031
Reporter SecuriteInfoCom
Tags:exe signed

Code Signing Certificate

Organisation:Beijing Huorong Network Technology Co., Ltd.
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2021-03-01T00:00:00Z
Valid to:2024-02-29T23:59:59Z
Serial number: 7b49493cc1d5e73e4fa9eba4cdba3fd6
Intelligence: 5 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 063cdf1f7e370e428165ce2e89f4816be73a9ac4458b739a7e66b7cb79456f3c
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
428
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/477631/
Detection(s):
SecuriteInfo.com.Trojan.MulDrop21.32565.4564.27113.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.Pequake-4
Create hunting rule

ditekSHen.MALWARE.Win.Ransomware.KillMBR.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the drivers directory
Loading a system driver
Creating a file in the Windows subdirectories
Creating a window
Enabling autorun for a service
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm crypto fingerprint lolbin overlay packed packed packed powershell rat shell32 upx
Link:
https://www.filescan.io/uploads/65da50dce304215defb6b603/reports/3dc30e0c-fa3d-4077-a57a-3336dfac7f4b/overview
Verdict:
Suspicious
Labled as:
Trojan/SGeneric
Link:
https://www.hybrid-analysis.com/sample/c42aa3048aeb7415fa3fbc93700fef04354aca6f5fe907dd7b86f7858e2a28d3
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/785fc30b-fcba-41af-a43a-6025b0f1cb30
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
42 / 100
Link:
https://www.joesandbox.com/analysis/1398240
Signature
Contains functionality to infect the boot sector
May modify the system service descriptor table (often done to hook functions)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
43%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/c42aa3048aeb7415fa3fbc93700fef04354aca6f5fe907dd7b86f7858e2a28d3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c42aa3048aeb7415fa3fbc93700fef04354aca6f5fe907dd7b86f7858e2a28d3/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yqvkgbek5n2bl6r7xsjxad7paq2uvstpl7uqpxl3q33yldrkfdjq._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence upx
Link:
https://tria.ge/reports/240224-y7vjgsdg32/
Behaviour
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Executes dropped EXE
Loads dropped DLL
UPX packed file
Drops file in Drivers directory
Sets service image path in registry
Unpacked files
SH256 hash:
1e40769abdd24e30558799e8552a49b53536a15e424aba1ad26178fae64eda8a
MD5 hash:
b7fcc85055d4b949fdc330cc1a250fcc
SHA1 hash:
d26f4b0db719e070e3be7bc7b071d026f7222c68
Link:
https://www.unpac.me/results/fc2f5d76-140e-4871-935b-844c89083f56/
SH256 hash:
c9a1a5a6dd8062b212be23cb6d6ad43a1714d720d4921c67d7ab7d3093de284f
MD5 hash:
9990b28c45daebef3d4d9954df315476
SHA1 hash:
23db23e1e432f4f64a6df20a06c3977a290c1667
Link:
https://www.unpac.me/results/fc2f5d76-140e-4871-935b-844c89083f56/
SH256 hash:
c42aa3048aeb7415fa3fbc93700fef04354aca6f5fe907dd7b86f7858e2a28d3
MD5 hash:
866f4c3885ca96d8f41d65b4bbe91612
SHA1 hash:
9612d39ff4efcb621e2e0f69abb8dfcd37deb02f
Link:
https://www.unpac.me/results/fc2f5d76-140e-4871-935b-844c89083f56/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c42aa3048aeb7415fa3fbc93700fef04354aca6f5fe907dd7b86f7858e2a28d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/477631/

Comments