MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc78a14cb3bff140e2b55b0acfbb6e90abb3b14c6cdeb7042ed2bb89858bb25f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc78a14cb3bff140e2b55b0acfbb6e90abb3b14c6cdeb7042ed2bb89858bb25f
SHA3-384 hash: f24ea8ca67ec210369234cd21fc73ebaff07232406bd5f6a5710a03c642a4002df1496c4eedac616b66e2a3df0d6b52a
SHA1 hash: 4c2854d8f29788751aa685fb5f942635a98c9675
MD5 hash: bbae1cd42541786ef902955d36e5b29c
humanhash: two-mirror-two-crazy
File name:Download Tracking Reference.exe
Download: download sample
File size:1'579'008 bytes
First seen:2023-05-11 20:31:10 UTC
Last seen:2023-05-12 11:24:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:N0mHd3orKY1ZIErYsOtO7QhQ82KkU9CWaQMf0Roo6GbnbZgUe0nN0C4hz/:PePZxraOshQzKkU9aQ+woo6Gb+URNC7
Threatray 505 similar samples on MalwareBazaar
TLSH T100750140023BAFE1C9A557F0721474434B3DA61A75B4E1BCBEA778C8C99AB109FD4A73
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter TeamDreier
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
258
Origin country :
DK DK
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Download Tracking Reference.exe
Verdict:
Suspicious activity
Analysis date:
2023-05-11 20:32:56 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/de80e918-6e01-4c4d-b5d0-5859988025c8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/388551/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/645d50c6c895be5a6e069e5d/reports/2eea9028-23ff-4b66-95e9-520aec62d5ca/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/cc78a14cb3bff140e2b55b0acfbb6e90abb3b14c6cdeb7042ed2bb89858bb25f
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6e12f30c-bb42-4f7b-a8d7-518a2fb8ec65
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1231138
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Contains functionality to modify clipboard data
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 864120 Sample: Download_Tracking_Reference.exe Startdate: 11/05/2023 Architecture: WINDOWS Score: 60 23 Multi AV Scanner detection for submitted file 2->23 25 .NET source code contains potential unpacker 2->25 7 Download_Tracking_Reference.exe 4 2->7         started        process3 file4 21 C:\...\Download_Tracking_Reference.exe.log, ASCII 7->21 dropped 27 Contains functionality to modify clipboard data 7->27 29 Adds a directory exclusion to Windows Defender 7->29 11 powershell.exe 20 7->11         started        13 Download_Tracking_Reference.exe 7->13         started        15 Download_Tracking_Reference.exe 7->15         started        17 Download_Tracking_Reference.exe 7->17         started        signatures5 process6 process7 19 conhost.exe 11->19         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc78a14cb3bff140e2b55b0acfbb6e90abb3b14c6cdeb7042ed2bb89858bb25f/
Threat name:
ByteCode-MSIL.Adware.RedCap
Create hunting rule
Status:
Malicious
First seen:
2023-05-11 08:25:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
17 of 24 (70.83%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zr4kctftx7yubyvvlmfm7o3oscv3hmkmntplobbo2k5ytbmlwjpq._file
Verdict:
malicious
Similar samples:
1f06e9fbca301c8973f846320f64cd64e09a55a178add77b72d893cb781bc80c
37e5285ef075235abeed2a5bfbf0398cd49945e77842a8e45fba2e4dcf0c819e
967357369e28e674971587037a5d24378a41b3e074ac20d24544d1703cccfee0
9678ca06068b705da310aa2f76713d2d59905b12b67097364160857cd1f90c58
af6da297a28d23c4d9837e63904c7ed8b28672e0a82da0e6aa14374fcade7873
cdc97952b1dcf484c5ea7e924883776f60a3e354c3028d4e3ca88112c497c56a
d92a606bedfa843a95a54253d544ecd03c944cce85da4183489ab1a77cb33624
+ 495 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230511-za9sksae58/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
AutoIT Executable
Suspicious use of SetThreadContext
Checks computer location settings
Unpacked files
SH256 hash:
3ab1dcc37e7c5c643bf41e9f0f81f816f24974fbddde95e2af52426e3374dd35
MD5 hash:
8a2c496875c0871aecc16aae768b323f
SHA1 hash:
f5423a32125c70b512de301c5616c7b75477e2e7
Link:
https://www.unpac.me/results/ae3c2096-2b51-4ac9-8d03-bb47aa50fb31/
SH256 hash:
60cc581e26bbf062d4ab2b01ba6e1bd761e898c447fedf406661ebd4b8b2eec9
MD5 hash:
57b1ab9c778234136a150324427d2235
SHA1 hash:
e89f7c2d31e25b299b8a648315891267b46924b0
Link:
https://www.unpac.me/results/ae3c2096-2b51-4ac9-8d03-bb47aa50fb31/
SH256 hash:
0356aa9370466d5e55ca02fb1a4252c15b541e71a3ff96da1efd67a42a9b525a
MD5 hash:
5345f4bc49b8d7445921cf3a38a49d27
SHA1 hash:
d623b7127455524243e6ba6320a27b52e05158ee
Link:
https://www.unpac.me/results/ae3c2096-2b51-4ac9-8d03-bb47aa50fb31/
SH256 hash:
47b15651a3fa3e8524b253130f0d3fd00a4a500a1a75f5a78964f367b0a2000b
MD5 hash:
17685f8f0e47a05501434a183df64e0c
SHA1 hash:
d22164cb485bf3791d669375dd1638e7043af76c
Link:
https://www.unpac.me/results/ae3c2096-2b51-4ac9-8d03-bb47aa50fb31/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/ae3c2096-2b51-4ac9-8d03-bb47aa50fb31/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
cc78a14cb3bff140e2b55b0acfbb6e90abb3b14c6cdeb7042ed2bb89858bb25f
MD5 hash:
bbae1cd42541786ef902955d36e5b29c
SHA1 hash:
4c2854d8f29788751aa685fb5f942635a98c9675
Link:
https://www.unpac.me/results/ae3c2096-2b51-4ac9-8d03-bb47aa50fb31/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cc78a14cb3bff140e2b55b0acfbb6e90abb3b14c6cdeb7042ed2bb89858bb25f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Executable exe cc78a14cb3bff140e2b55b0acfbb6e90abb3b14c6cdeb7042ed2bb89858bb25f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/388551/

Comments