MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d396db24c99713fcc6d31193995f84867d0e639b9c5c751d3e365ce6b1c3e7c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d396db24c99713fcc6d31193995f84867d0e639b9c5c751d3e365ce6b1c3e7c9
SHA3-384 hash: 87e4e33705e67a9ee804af8d88b89e75f7df3748c3add90cb92acc7cc63beebeef23a4bb8c9f7300ba66347c0ee549ab
SHA1 hash: 8149280cc174bccd8195dc63f7a514a2d1a5a91a
MD5 hash: 905edd517d85b47086d09c7a6ab91395
humanhash: asparagus-georgia-cat-video
File name:905edd517d85b47086d09c7a6ab91395
Download: download sample
File size:180'224 bytes
First seen:2022-12-11 18:24:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 3072:8w4m8SoIxKCCqtF88pj/EC4KQiVS8KAy7n6ku/RAK5XtNbN/BUyR:8w4DkyK88pDERKQi5/btBU
Threatray 4'421 similar samples on MalwareBazaar
TLSH T16904F81E3F809DAFC76B4F35C01B2910D620D6755207E706A58722B8AD4F3BAEE115F6
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter zbetcheckin
Tags:32 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/345253/
Detection(s):
SecuriteInfo.com.Variant.MSILPerseus.36239.27345.27948.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
confuserex packed
Link:
https://www.filescan.io/uploads/639620450c6473d1671a808c/reports/f307051e-a635-4c82-8acb-492d16a8bbcf/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fb026970-af8b-4d31-b236-475f902e363f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1132290
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d396db24c99713fcc6d31193995f84867d0e639b9c5c751d3e365ce6b1c3e7c9/
Threat name:
Win32.Network.Dictator
Create hunting rule
Status:
Malicious
First seen:
2022-12-11 18:24:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
23 of 26 (88.46%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2olnwjgjs4j7zrwtcgjzsx4eqz6q4y43trohkhj6gzoonmod47eq._file
Verdict:
malicious
Similar samples:
10df0ef277c2371fa904773d11c431664570eaca0e6c4e482383fe28979cb401
149a95862f10a14418b51f595cb28c9f80facdb4c21081661bfd490d3b46e857
41c6c378abbfa0b9b387b64c89f7c00785921c7d37f1c19c35d5b472a203163a
75517e683e81171572dab2526e9583d31c679744b12b251d7d6c6cf14f83f21a
884b73f88d5b30892c7cc1e60d8208d8cf14e5d1f2bebc6e58d7ba2ee31a634e
b170e8be5df12dfd6b17172ebdea00dd5c366c6dc443f32904ee49738c13a75c
cc883ff2da665b29da191f3e5ada7da98810684658676f84dc6275d98f52f151
+ 4'411 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/221211-w12m4shb74/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/befb6e8b-45ed-4508-a68a-769c8abf5fa4
Unpacked files
SH256 hash:
beea7ba61e0734f2340c7d7965d1ed89a2d9d5e059f8d1da5cca99e5bf5add05
MD5 hash:
5a0d65ced8c39e1b9bdec2e75a5ad603
SHA1 hash:
d9284c422d4278ce9a54b36e4d9a2a3667368a01
Link:
https://www.unpac.me/results/1027029d-8e76-4aca-a733-ce2fb368d4ec/
SH256 hash:
d396db24c99713fcc6d31193995f84867d0e639b9c5c751d3e365ce6b1c3e7c9
MD5 hash:
905edd517d85b47086d09c7a6ab91395
SHA1 hash:
8149280cc174bccd8195dc63f7a514a2d1a5a91a
Link:
https://www.unpac.me/results/1027029d-8e76-4aca-a733-ce2fb368d4ec/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/d396db24c99713fcc6d31193995f84867d0e639b9c5c751d3e365ce6b1c3e7c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe d396db24c99713fcc6d31193995f84867d0e639b9c5c751d3e365ce6b1c3e7c9

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2454370/
Cape
Cape
https://www.capesandbox.com/analysis/345253/

Comments


Avatar
zbet commented on 2022-12-11 18:24:03 UTC

url : hxxp://66.11.117.45/happy/Make.exe