MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd96e18da320ba4ac313d3a189776d7defbea7098cf53156b1e4b680eb9e4c68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


YoungLotus


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd96e18da320ba4ac313d3a189776d7defbea7098cf53156b1e4b680eb9e4c68
SHA3-384 hash: 90e5d26eac49938cd31d88e549366166cee6047dafdbcb499e6653a6d439dbfb604792989807d1a4f08c62a606b4b3f2
SHA1 hash: 268b5aef1f700c4a27c33678b614601261e71616
MD5 hash: 665d90fc3264e6f0b3a2b2e4fc715caf
humanhash: fillet-four-triple-delta
File name:665d90fc3264e6f0b3a2b2e4fc715caf.exe
Download: download sample
Signature YoungLotus
Create hunting rule
File size:288'385 bytes
First seen:2023-04-21 15:41:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1619c2fb0abae4a066cd55f93e5cd107 (3 x YoungLotus)
ssdeep 6144:Ipb0nofW70cc6rX8aZAG7p4q5LmSVNR/XnzBvqi3TFRL9QolQ:Ipb/fk5iGVbgshDBvqijFvRlQ
Threatray 38 similar samples on MalwareBazaar
TLSH T14F5423FF66FE3B09E05B7672208B3DDB5550041E49D44EAA0E37CA3996FC4386B34698
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe younglotus

Intelligence

File Origin
# of uploads :
1
# of downloads :
271
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
665d90fc3264e6f0b3a2b2e4fc715caf.exe
Verdict:
Malicious activity
Analysis date:
2023-04-21 15:49:21 UTC
Tags:
loader
Link:
https://app.any.run/tasks/95c5300f-ffc1-47dc-8f00-cdf71ab6441d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/383997/
Detection(s):
PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

PUA.Win.Packer.Anti-28
Create hunting rule

PUA.Win.Packer.Anti-29
Create hunting rule

PUA.Win.Packer.Nspack-5
Create hunting rule

PUA.Win.Packer.NPack-4
Create hunting rule

PUA.Win.Packer.Nspack-34
Create hunting rule

PUA.Win.Packer.Nspack-21
Create hunting rule

PUA.Win.Packer.Nspack-13
Create hunting rule

PUA.Win.Packer.Nspack-25
Create hunting rule

PUA.Win.Packer.Nspack-22
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the Windows directory
DNS request
Sending an HTTP GET request
Creating a file in the Program Files subdirectories
Enabling the 'hidden' option for recently created files
Sending a custom TCP request
Creating a process from a recently created file
Launching a process
Creating a process with a hidden window
Searching for synchronization primitives
Creating a file in the %temp% directory
Creating a service
Launching a service
Loading a system driver
Moving a recently created file
Searching for the window
Enabling autorun for a service
Moving of the original file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed shell32.dll
Link:
https://www.filescan.io/uploads/6442aecc7ee5da80cfe0002e/reports/b70a376f-3faf-489f-930b-a33e0d6d78bd/overview
Verdict:
Malicious
Labled as:
Graftor.Generic
Link:
https://www.hybrid-analysis.com/sample/cd96e18da320ba4ac313d3a189776d7defbea7098cf53156b1e4b680eb9e4c68
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/43ae1824-d2df-40c3-be53-0f3eda1ec574
Result
Threat name:
Young Lotus
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1218802
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Changes security center settings (notifications, updates, antivirus, firewall)
Checks if browser processes are running
Contains functionality to detect sleep reduction / modifications
Drops PE files with benign system names
Found stalling execution ending in API Sleep call
Machine Learning detection for dropped file
Machine Learning detection for sample
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Snort IDS alert for network traffic
Uses known network protocols on non-standard ports
Uses regedit.exe to modify the Windows registry
Yara detected Young Lotus
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 851744 Sample: nM8qahLjTF.exe Startdate: 21/04/2023 Architecture: WINDOWS Score: 100 52 Snort IDS alert for network traffic 2->52 54 Antivirus detection for URL or domain 2->54 56 Antivirus detection for dropped file 2->56 58 10 other signatures 2->58 7 nM8qahLjTF.exe 13 2->7         started        12 svchost.exe 2->12         started        14 svchost.exe 3 2->14         started        16 7 other processes 2->16 process3 dnsIp4 46 www.jz3366.top 211.101.237.65, 2021, 49698, 49699 CLOUD-ARKBeijingCloud-ArkTechnologyCoLtdCN China 7->46 38 C:\Program Files\windows nt\smss.exe, PE32 7->38 dropped 40 C:\Windows\ServerName.reg, Windows 7->40 dropped 42 C:\Windows\srvany.exe, PE32 7->42 dropped 62 Moves itself to temp directory 7->62 64 Uses regedit.exe to modify the Windows registry 7->64 66 Drops PE files with benign system names 7->66 68 Contains functionality to detect sleep reduction / modifications 7->68 18 smss.exe 10 7->18         started        22 regedit.exe 10 7->22         started        70 Changes security center settings (notifications, updates, antivirus, firewall) 12->70 24 MpCmdRun.exe 1 12->24         started        72 Query firmware table information (likely to detect VMs) 14->72 48 192.168.2.1 unknown unknown 16->48 file5 signatures6 process7 file8 32 C:\Users\user~1\...\TemporaryFile (copy), PE32+ 18->32 dropped 34 C:\Users\user\AppData\Local\...\UGd10Cwd.sys, PE32+ 18->34 dropped 36 C:\Program Files\windows nt\win.exe, PE32 18->36 dropped 60 Sample is not signed and drops a device driver 18->60 26 win.exe 1 1 18->26         started        30 conhost.exe 24->30         started        signatures9 process10 dnsIp11 50 www.jz3366.top 26->50 44 C:\Windows\csrsss.exe, PE32 26->44 dropped file12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd96e18da320ba4ac313d3a189776d7defbea7098cf53156b1e4b680eb9e4c68/
Threat name:
Win32.Trojan.Siscos
Create hunting rule
Status:
Malicious
First seen:
2023-04-19 14:57:51 UTC
File Type:
PE (Exe)
Extracted files:
42
AV detection:
22 of 35 (62.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zwloddndec5evqyt2oqys53npxx35jyjrt2tcvvr4s3ib246jrua._file
Verdict:
malicious
Similar samples:
49fe889b5081ebb969a26d2eecab566c2ccad3972ee21513fe61994110267714
YoungLotus
d727f725ef0c3837013468f9675b6a0531658d8e60f01e5762e130cbabd665d0
YoungLotus
fde687287ef8cd7e6a6ce655355eaca2fba25fd6c22cc1e4040281f73205ba90
YoungLotus
+ 28 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/230421-s5cb8sge38/
Behaviour
Checks processor information in registry
Runs .reg file with regedit
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Downloads MZ/PE file
Sets service image path in registry
Unpacked files
SH256 hash:
cd96e18da320ba4ac313d3a189776d7defbea7098cf53156b1e4b680eb9e4c68
MD5 hash:
665d90fc3264e6f0b3a2b2e4fc715caf
SHA1 hash:
268b5aef1f700c4a27c33678b614601261e71616
Link:
https://www.unpac.me/results/66c1e2c1-e580-4f8c-97cf-8290770e2efb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cd96e18da320ba4ac313d3a189776d7defbea7098cf53156b1e4b680eb9e4c68

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

YoungLotus

Executable exe cd96e18da320ba4ac313d3a189776d7defbea7098cf53156b1e4b680eb9e4c68

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2615583/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/383997/

Comments