MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4b4f0e3c29dcd4732bafa345616d73211c86eebccaa84e770c456d0c6f118df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4b4f0e3c29dcd4732bafa345616d73211c86eebccaa84e770c456d0c6f118df
SHA3-384 hash: 6b5a4b19d7ddfe3064f3742af02b29f4354845e381f37ee50538251e1f3719f124dd0afe17b3a41d3b1b7edd9a1b05b7
SHA1 hash: 28202731341e2e3991de00964d21233f16916109
MD5 hash: 55b6d906ef1a828aefd2ed665086b602
humanhash: oranges-twenty-happy-seven
File name:55b6d906ef1a828aefd2ed665086b602
Download: download sample
File size:2'433'024 bytes
First seen:2021-10-15 18:28:58 UTC
Last seen:2021-10-15 20:09:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cea7ae85c87ddc7295d39ff9cda31d1 (85 x RedLineStealer, 71 x LummaStealer, 62 x Rhadamanthys)
ssdeep 49152:WOX70Y1vJ2kfI3p1o9v7Dx/pP4EPDpDSjxF6gVlpcl3l:NoY2kfI3k9zDxxPWXVTc
Threatray 30 similar samples on MalwareBazaar
TLSH T1A3B5E04213D1E7BBECE26ABF4F73C203165F2F9167B41DAA1D01855EB91295320E7A0E
File icon (PE):PE icon
dhash icon 71f4808888c2c461 (1 x AsyncRAT)
Reporter zbetcheckin
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
331
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/197808/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.1032.15533.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a file
Moving a recently created file
Deleting a recently created file
DNS request
Connecting to a non-recommended domain
Connection attempt
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6169c870db358dd15eba4723/reports/0d460549-fb15-4c9c-8a8f-0a31c6ec11e2/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/1f15c7df-2596-4e3c-8d44-acd55e8f662f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/871298
Signature
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4b4f0e3c29dcd4732bafa345616d73211c86eebccaa84e770c456d0c6f118df/
Verdict:
unknown
Similar samples:
197473ef9099e43c74fc5dd19776cb4e001ccd39102c38c3bfa3f81db9fd92bb
243b5b84bb63e98fb3d54e4e1d8592c367540a79f677a464f2c2ea5491f4c90f
3eba0dc8845aed9cb930bab85515af193da93dffff8a2def181c92999b7afeb8
5139ad11a48646552189e064b132a68728a2b53bb93cc2c96f737fd9271852fa
6c8e5f1670515c6a9d3cdcafe6d9a782a87f0f085095558cc0116ea73281c059
75b77800228079a5b6b94166581b2b406f6dca7baf3a9fb163aa0a2d2a89926b
947b5393f12d2a410be2390fbd37be20705d06a67672af5dc71bd86e8c50a025
bf0b6e7c79d0507e85ebad255973e90fa1ee1b6ae2eb408c4866aeb9322a9e5c
+ 20 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/211015-w4w7sscafl/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Unpacked files
SH256 hash:
d4b4f0e3c29dcd4732bafa345616d73211c86eebccaa84e770c456d0c6f118df
MD5 hash:
55b6d906ef1a828aefd2ed665086b602
SHA1 hash:
28202731341e2e3991de00964d21233f16916109
Link:
https://www.unpac.me/results/ad0f9c96-4c5e-49b0-9a0b-cb8cc480f2ae/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d4b4f0e3c29dcd4732bafa345616d73211c86eebccaa84e770c456d0c6f118df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe d4b4f0e3c29dcd4732bafa345616d73211c86eebccaa84e770c456d0c6f118df

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1681691/
Cape
Cape
https://www.capesandbox.com/analysis/197808/

Comments


Avatar
zbet commented on 2021-10-15 18:29:00 UTC

url : hxxps://pixeldrain.com/api/file/zhpmb1B9?download/