MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Patchwork


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87
SHA3-384 hash: e31934fc871e6cb81e7f79eeafe03330036467cd915410852824ea279eabbc68ee46ca7f1d3137016aec9ecd7f499765
SHA1 hash: 5947aa44d3c8e5d3e31667553dbdc104426b57ee
MD5 hash: 1aa6f499158d4b7141db67d7038cda8d
humanhash: cup-delaware-pasta-sierra
File name:ueworoejvdvhruthqq3.exe
Download: download sample
Signature Patchwork
Create hunting rule
File size:202'752 bytes
First seen:2024-04-18 13:43:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 33ef024f7714441fd58d95eeed6ec742 (1 x Patchwork)
ssdeep 3072:cNOEmZoEfUHeZbe3+xW3Yf+83C63QU8rgP6A6NL6AW9SI1eBzKR:c4BZ6S5W3kV3p3QU9iA8LvaSseBO
Threatray 12 similar samples on MalwareBazaar
TLSH T1C9149E26B64154FDD46BC0B082969532B972BCC84B347EFF6690B3396D32AE47E3C644
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter smica83
Tags:apt exe Patchwork

Intelligence

File Origin
# of uploads :
1
# of downloads :
433
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87.exe
Verdict:
Malicious activity
Analysis date:
2024-04-18 13:46:38 UTC
Tags:
evasion
Link:
https://app.any.run/tasks/1fb31b6e-0fd9-401e-8258-7778d41a416b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Running batch commands
Launching a process
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm packed
Link:
https://www.filescan.io/uploads/662123a914fabb16f4fe1c35/reports/6110743a-1f07-4395-884c-d644caff0926/overview
Verdict:
Malicious
Labled as:
DeepScan:Generic.ShellCode.Donut.Marte.1
Link:
https://www.hybrid-analysis.com/sample/d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c1dc027a-c779-4184-ae12-001a85c30ee1
Result
Threat name:
Patchwork
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1428137
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to capture screen (.Net source)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Uses nslookup.exe to query domains
Yara detected Patchwork
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1428137 Sample: ueworoejvdvhruthqq3.exe Startdate: 18/04/2024 Architecture: WINDOWS Score: 84 33 resolver1.opendns.com 2->33 35 15731.org 2->35 47 Malicious sample detected (through community Yara rule) 2->47 49 Antivirus / Scanner detection for submitted sample 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 3 other signatures 2->53 8 ueworoejvdvhruthqq3.exe 14 3 2->8         started        signatures3 process4 dnsIp5 45 15731.org 38.180.94.120, 443, 49703, 49704 COGENT-174US United States 8->45 11 cmd.exe 1 8->11         started        14 cmd.exe 8->14         started        16 cmd.exe 1 8->16         started        18 conhost.exe 8->18         started        process6 signatures7 55 Uses nslookup.exe to query domains 11->55 20 nslookup.exe 1 11->20         started        23 conhost.exe 11->23         started        25 nslookup.exe 1 14->25         started        27 conhost.exe 14->27         started        29 WMIC.exe 1 16->29         started        31 conhost.exe 16->31         started        process8 dnsIp9 37 222.222.67.208.in-addr.arpa 20->37 39 myip.opendns.com 20->39 41 222.222.67.208.in-addr.arpa 25->41 43 myip.opendns.com 25->43
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87/
Threat name:
Win64.Trojan.RustyStealer
Create hunting rule
Status:
Malicious
First seen:
2024-04-18 10:08:59 UTC
File Type:
PE+ (Exe)
AV detection:
18 of 23 (78.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2dgk2jcszqasjwksct42trpe36oyil4xyy4jy3qbxkqjcyygvwdq._file
Verdict:
malicious
Similar samples:
68ff2070f86702b8b08d0c1aa088e3bcfd17a54e07883a78e3959b7ad79f4037
Patchwork
959069fecdbd4347ec53719f06a8aab2d58d2ad121129e7de595013d52a52aff
Patchwork
a21c2b6912772143895aa9ac106b3d0f31dee43fb8167c43f8f54aafda5783a3
Patchwork
ca24347d80aed81df2a0e89075c645bfd6081a8e66103ea680f3a8758999b32b
Patchwork
d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87
Patchwork
d6fcf0bcebcac7aa5e7b21b189dbd89f314f79871b770911a7d7b780207fb83d
Patchwork
+ 2 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/240418-q1ssbaeg45/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unexpected DNS network traffic destination
Unpacked files
SH256 hash:
d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87
MD5 hash:
1aa6f499158d4b7141db67d7038cda8d
SHA1 hash:
5947aa44d3c8e5d3e31667553dbdc104426b57ee
Link:
https://www.unpac.me/results/063b7354-b4de-43c7-9414-55c519138583/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/k3yp0d/status/1780929459689758926?t=S7kVyyGV___pNgRxtErZfQ&s=19

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryA
WIN_BASE_EXEC_APICan Execute other programskernel32.dll::WriteConsoleW
kernel32.dll::GetConsoleMode
kernel32.dll::GetConsoleWindow

Comments