MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb33c7dada72bf9d0ea986610bcf7d8c5a28ac720652f9e50194de023a38f2c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb33c7dada72bf9d0ea986610bcf7d8c5a28ac720652f9e50194de023a38f2c7
SHA3-384 hash: 0cb6ee287ffeb7c85642cf598b3f567b7bfabc7f2392480364df829b24120afee95467d920e7014186c293e17ef430c3
SHA1 hash: 09cc2971e6f8fc8166866a577a783f0f55b7d9c1
MD5 hash: cbaa7b936c2c0cd1de0a037169691d42
humanhash: kansas-lake-two-low
File name:cbaa7b936c2c0cd1de0a037169691d42.exe
Download: download sample
File size:325'120 bytes
First seen:2021-08-11 16:01:39 UTC
Last seen:2021-08-11 17:06:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a4e471c7fd9fdda76efc364ccf330c71 (4 x RaccoonStealer, 1 x DanaBot, 1 x RedLineStealer)
ssdeep 3072:gFzq5/Lj6iluLariEQW6rCuOZyNc7j0IysL/wd6/iPl7B5DeH1ScsYh6gSVywo3J:IIVlbiLW6rCugj3ysL4RTf7knGyHM
Threatray 9 similar samples on MalwareBazaar
TLSH T12664D0117FBCD872D49509310821CBB4667FAD21BD65518B7B983B2FFEB03E1262225A
dhash icon 4839b2b4e8c38890 (137 x RaccoonStealer, 37 x Smoke Loader, 30 x RedLineStealer)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8c923bbef41c0b7555c646ee53ec23a5.exe
Verdict:
Malicious activity
Analysis date:
2021-08-11 11:59:49 UTC
Tags:
loader
Link:
https://app.any.run/tasks/61ba15b6-888a-4f26-beee-20bb9acbe050

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178330/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.2567.31386.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file
Launching the default Windows debugger (dwwin.exe)
Creating a process from a recently created file
Creating a process with a hidden window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0d435316-d356-4d3e-8e7c-1a79f0059adf
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/831114
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: System File Execution Location Anomaly
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb33c7dada72bf9d0ea986610bcf7d8c5a28ac720652f9e50194de023a38f2c7/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2021-08-11 12:02:50 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
30715cfa9a065a5487098b26e563339ce8c1d12e468f9e418106cae9713eb7d6
5185c2ed67f7d2b19d3fe2ea6e1d6c89e597f633a5df206bd536620411e7db77
7cf7cdb9043622708726ba0a16c4c4ffdcae7a603708a5a5dbca6c0973ccc1f4
8f2789b6a628a92f9f6313305b255c405f867c49161bb864263dcfef5a6f712d
96ab0a5a858b541c6e6fc44588405d29f8ba18bf8e8ff4af25b235135bbfd01a
b2ef736fad89cf9a80e5c37e4c8e0bcfec77ab815f4176f939569b0b525b8de5
dcd159c8484feb2b4b1db173cdbc3eb3b49c0b6c2b6bec43ec736243cb60b07d
de83c34f12bd4585c2428b672648046e3cd4e7489adb6bdcd592b2751a901cc1
e33c5b9d362c0f6a91945fdcb337f4e90d2cdf9397fac4ee0b5af9d7a96e4956
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan
Link:
https://tria.ge/reports/210811-xrt5mmcjh6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Adds Run key to start application
Drops startup file
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Defender Real-time Protection settings
Malware Config
Dropper Extraction:
http://91.241.19.52/Api/GetFile2
Unpacked files
SH256 hash:
f9e3e8581ad5a275c92af14ff1e8a41a4c95e76652ceb37c732e3e4aa7224be3
MD5 hash:
1001a990bb8f8671f88e09bb18c0f9c5
SHA1 hash:
faeb200855e7633a855881890964399458dea851
Link:
https://www.unpac.me/results/aa30a181-2ebe-48a6-959c-3deab50451fc/
SH256 hash:
cb33c7dada72bf9d0ea986610bcf7d8c5a28ac720652f9e50194de023a38f2c7
MD5 hash:
cbaa7b936c2c0cd1de0a037169691d42
SHA1 hash:
09cc2971e6f8fc8166866a577a783f0f55b7d9c1
Link:
https://www.unpac.me/results/aa30a181-2ebe-48a6-959c-3deab50451fc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb33c7dada72bf9d0ea986610bcf7d8c5a28ac720652f9e50194de023a38f2c7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe cb33c7dada72bf9d0ea986610bcf7d8c5a28ac720652f9e50194de023a38f2c7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1524012/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1523998/
Cape
Cape
https://www.capesandbox.com/analysis/178330/

Comments