MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d27fc5641cadee2fe89f1a23264ae10879cde5702397a4bb3c6ace6e583bc4b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mekotio


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d27fc5641cadee2fe89f1a23264ae10879cde5702397a4bb3c6ace6e583bc4b7
SHA3-384 hash: 7360e86f48db0d6f817ea152f65804855e4cb76b096115e633d82d2bce5f70d537f55450180e2240a47f0823c02132a9
SHA1 hash: d12aee1a906d1c24fd3f1d8817f150e4300e5637
MD5 hash: a9f85da3d8367497b7fe30190bfb9031
humanhash: london-snake-mike-undress
File name:8000217HJX5SD71253A2.msi
Download: download sample
Signature Mekotio
Create hunting rule
File size:6'102'016 bytes
First seen:2023-01-19 15:47:25 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:IYStMHAjYkllEspbROdAhNDIalOqV5GSRcUrjXUX5B2R5Zj173pu5grmPYpVsYU:2fFlrpbAdAvD4qfGhUrjmGj7ql0VsY
Threatray 18'761 similar samples on MalwareBazaar
TLSH T185562323B2954136C0DD85714A3BFE9621F52B2ADBA390FB6AC82DDD35725D08363D83
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:CHL geo Mekotio msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
CH CH
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/354643/
Detection(s):
SecuriteInfo.com.W32.Trojan.VYZK-4288.30727.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
80%
Tags:
packed packed shell32.dll
Link:
https://www.filescan.io/uploads/63c966331c9cbf7d625055e0/reports/a7821954-de54-4f5a-9362-30ffcce625fa/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/d27fc5641cadee2fe89f1a23264ae10879cde5702397a4bb3c6ace6e583bc4b7
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1154816
Signature
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with function prologues
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d27fc5641cadee2fe89f1a23264ae10879cde5702397a4bb3c6ace6e583bc4b7/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2j74kza4vxxc72e7dirsmsxbbb443zlqeol2joz4nlhg4wb3ys3q._file
Verdict:
malicious
Similar samples:
22cd5219921662102a753b209caadea1d636cef6ca0676c5c6e3c6a909bdf0dd
Mekotio
248b0f8740d4c1772675dd789d4995e00ef5b9ed8503e5760cd2eb6e731aff90
Mekotio
635329a3e60baf7fc0d50d16b87c4ddc8f9300c710696dde863c3d90abb1b4a3
Mekotio
63f3996126283fd499958cd927dab52f6f4c746af5f2a89048b593de9fbea39d
Mekotio
7b70a9f0ae0486dd4a44dac7e1ce310948ecceb2fb764d978e1aec80069cf0b8
Mekotio
820194153174a679179e3649a4ebac8f39b4fefd2836d19ae1241e4e520fae26
Mekotio
82a8b539cef9ef4e6709f01fbeefb4a14618805a3e23c717255f87b69d014ee8
Mekotio
964fbbc3b3a80e3e378e88f8c523d72e539ba06e46643ed212bc0609871fff4e
Mekotio
c63c78a081a78186d21c5df2a302b9f49fe35f85339692a1d8972a10dbabe042
Mekotio
d34e63dbaeb352c7fbf69e3afcd140ca188aaf9492bbb209401bdbcc6028b07c
Mekotio
+ 18'751 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/230119-s8rw4add7s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Enumerates connected drives
Looks up external IP address via web service
Loads dropped DLL
Blocklisted process makes network request
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d27fc5641cad/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/d27fc5641cadee2fe89f1a23264ae10879cde5702397a4bb3c6ace6e583bc4b7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/1ZRR4H/status/1616097608887418881
  
URLhaus
https://urlhaus.abuse.ch/url/2512518/
  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/354643/

Comments