MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d0317ad7c973c5aa91f1e930093916db9969fd023e00efd89e01bd7fb7408016. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Simbot
Vendor detections: 8
| SHA256 hash: | d0317ad7c973c5aa91f1e930093916db9969fd023e00efd89e01bd7fb7408016 |
|---|---|
| SHA3-384 hash: | 413c8061d84e09acdc4aef6117fd1e9a99edd75108d5f3a1d54f2d7e41c98f28cd37034c738eedd0ca1539bf8928dad2 |
| SHA1 hash: | 5c7cecf2f6be0a54dada4f63ee08563e8250de98 |
| MD5 hash: | 15b290a45f7e3a49d7941d8c386d44b0 |
| humanhash: | network-fillet-apart-eighteen |
| File name: | virussign.com_15b290a45f7e3a49d7941d8c386d44b0 |
| Download: | download sample |
| Signature | Simbot |
| File size: | 1'937'193 bytes |
| First seen: | 2022-07-15 14:29:53 UTC |
| Last seen: | 2024-07-24 21:38:51 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | e569e6f445d32ba23766ad67d1e3787f (258 x Adware.Generic, 41 x RecordBreaker, 24 x RedLineStealer) |
| ssdeep | 24576:t7FUDowAyrTVE3U5Fms4JTx2iGDYfxmxZik25x7awFhJdNo69lOy7KTijls:tBuZrEUiJ9NxWgr55DdN7POGjq |
| Threatray | 300 similar samples on MalwareBazaar |
| TLSH | T1F595C03FF268A13EC56A1B3205B39210997BBA61B81A8C1F47FC344DCF765601E3B656 |
| TrID | 49.7% (.EXE) Inno Setup installer (109740/4/30) 19.5% (.EXE) InstallShield setup (43053/19/16) 18.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 4.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.0% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 5050d270cccc82ae (109 x Adware.Generic, 43 x LummaStealer, 42 x OffLoader) |
| Reporter |  KdssSupport |
| Tags: | exe Simbot |
Intelligence
File Origin
# of uploads :
3
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Searching for the window
Launching a process
DNS request
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
overlay packed setupapi.dll shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Threat name:
Win32.Trojan.Convagent
Status:
Malicious
First seen:
2022-07-13 07:24:10 UTC
File Type:
PE (Exe)
AV detection:
16 of 26 (61.54%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 290 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
evasion suricata trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Checks BIOS information in registry
Checks computer location settings
Loads dropped DLL
Unexpected DNS network traffic destination
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
Malware Config
Dropper Extraction:
http://hyperhyper8.com/welcome
Unpacked files
SH256 hash:
6904589b4f2ad4daa85b7d4dc715d42563b2fbc9ddbcb777167ec38086c9513d
MD5 hash:
cd98b0b64fdb0829c72b59c435eb85a9
SHA1 hash:
b298d35a7b7b893f2b903bd33e10a5e3b66c06da
SH256 hash:
b1aa3683da9e4d148f4a00decaaf3a1604364efdbed2646e487def619cab8b92
MD5 hash:
44b7835c5ee663edac36effeee177b8a
SHA1 hash:
601b4d12ed29bc3e2390875ee8eeb8362fd5e6cf
SH256 hash:
d0317ad7c973c5aa91f1e930093916db9969fd023e00efd89e01bd7fb7408016
MD5 hash:
15b290a45f7e3a49d7941d8c386d44b0
SHA1 hash:
5c7cecf2f6be0a54dada4f63ee08563e8250de98
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | cobalt_strike_tmp01925d3f |
|---|---|
| Author: | The DFIR Report |
| Description: | files - file ~tmp01925d3f.exe |
| Reference: | https://thedfirreport.com |
| Rule name: | INDICATOR_EXE_Packed_MPress |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables built or packed with MPress PE compressor |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries and memory artifcats referencing sandbox DLLs typically observed in sandbox evasion |
| Rule name: | INDICATOR_SUSPICIOUS_References_SecTools |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many IR and analysis tools |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.