MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce1c2e089ab14ef543b6604bd4fd82213708b89372fd63d414ff6e694ddce4ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Pitou

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments 1

SHA256 hash:	ce1c2e089ab14ef543b6604bd4fd82213708b89372fd63d414ff6e694ddce4ad
SHA3-384 hash:	c1ef8cc4abe6b05296fdb84da37230e68dcc9137c7375d9115b5f2e28f133f2fb483653f0da4efa45ad27c1ead11db3b
SHA1 hash:	7ba0a397b0cd26180ea94bf3928fc5d4a1db22e5
MD5 hash:	5baaf7e2ee2fdfac2a4871b2a7e240e4
humanhash:	indigo-glucose-connecticut-don
File name:	5baaf7e2ee2fdfac2a4871b2a7e240e4
Download:	download sample
Signature	Pitou Create hunting rule
File size:	699'392 bytes
First seen:	2021-08-10 10:03:50 UTC
Last seen:	2021-08-10 10:40:57 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	cc4caabe2c1a9c923331965c9764375d (3 x Pitou, 2 x RedLineStealer, 2 x GCleaner)
ssdeep	12288:NMttNi9QvhSSYFwKzeNhfL3CwICzSqJRRMxNyJN+Uyy6pDcSluMeU:AjsQvfhfL3CwmqpJ49hJYMeU
Threatray	12 similar samples on MalwareBazaar
TLSH	T141E4F130B7A0C035F5B721FC45A6A3BCAA2D3AA16B7041CF53D01AEE57246E4AD31397
dhash icon	68e8e8e8aa66a499 (33 x RaccoonStealer, 14 x ArkeiStealer, 11 x RedLineStealer)
Reporter	zbetcheckin
Tags:	32 exe Pitou

Intelligence

File Origin

# of uploads :

# of downloads :

904

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

5baaf7e2ee2fdfac2a4871b2a7e240e4

Verdict:

Malicious activity

Analysis date:

2021-08-10 10:07:06 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/1515aa5f-b22f-4928-86b4-2df4e8438977

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/177880/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.20122.3429.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Possible injection to a system process

Blocking the Windows Defender launch

Rewriting of the hard drive's master boot record

Unauthorized injection to a system process

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Pitou

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a0889534-2693-4f02-a2f7-69b994e972d3

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/830056

Signature

Contains functionality to infect the boot sector

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ce1c2e089ab14ef543b6604bd4fd82213708b89372fd63d414ff6e694ddce4ad/

Result

Malware family:

n/a

Score:

6/10

Tags:

bootkit persistence

Link:

https://tria.ge/reports/210810-zhjgbsdbcs/

Behaviour

Suspicious use of AdjustPrivilegeToken

Writes to the Master Boot Record (MBR)

Unpacked files

SH256 hash:

40952c341d05273c0c581ee26718e131666f4def5ae9839c686ba5e6bd57ba7d

MD5 hash:

7a37018d3bb55b535803345f8dfc14db

SHA1 hash:

008e8644fec789c07acea71ebd5a31742a3fa42c

Detections:

win_pitou_auto

Link:

https://www.unpac.me/results/9a525050-80ce-4169-8b47-b872550ab3af/

Parent samples :

829f2d1a30848cec9b28b47782537ad64a3770d6b22359c0d3f5257215b49105
ce1c2e089ab14ef543b6604bd4fd82213708b89372fd63d414ff6e694ddce4ad
66cebd1b0a87df2ddcd805723d15e8094c23dfe1d4a2108348579995a102c994
7432d519a0a8042c26d8fa9637c9c07de4c33cde886feb1fbc063f1a5d828ed4
dd1dc97c210d7ed5cfe8c72bd8dd28bb080dcf1444d9770fdd7c5c436de345e5
b6b28602888cb4f4335d3e02a0a91cd945a64f1c5cd6372cf70aad05dc5c0d30
440de5c3ce1c9cf276516354babcae98f726b2f6a16d747f5ca2154b0e450410
d7eecb951a6b4439f8b71fc6b6d71b1892ee0c3ca26ae2e3fda22960515d8963
4004d8d0d2163211efed5e32a184c3842f643f02b29c5b619bb4ef97a8afc3e6

SH256 hash:

ce1c2e089ab14ef543b6604bd4fd82213708b89372fd63d414ff6e694ddce4ad

MD5 hash:

5baaf7e2ee2fdfac2a4871b2a7e240e4

SHA1 hash:

7ba0a397b0cd26180ea94bf3928fc5d4a1db22e5

Link:

https://www.unpac.me/results/9a525050-80ce-4169-8b47-b872550ab3af/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/ce1c2e089ab1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ce1c2e089ab14ef543b6604bd4fd82213708b89372fd63d414ff6e694ddce4ad

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Pitou

exe ce1c2e089ab14ef543b6604bd4fd82213708b89372fd63d414ff6e694ddce4ad

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1521622/

Cape

https://www.capesandbox.com/analysis/177880/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-08-10 10:03:51 UTC

url : hxxp://37.120.239.108/200.exe