MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d552f35307e9ce4ea735c7fdddb4bf737463daa68b19b8e02f19a45b3339b928. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d552f35307e9ce4ea735c7fdddb4bf737463daa68b19b8e02f19a45b3339b928
SHA3-384 hash: 5a8ca44fb885dfdbb2fc663907ba32cc4f3a2ff19565d0e34f9b17bc490bc79b123a1a3a2fdaf49e0cbfe69ff5acf972
SHA1 hash: 396fd1ba48a89823ede711922ccda47931532d64
MD5 hash: 07ff6173347653f4a7c1fcb2551ef2d9
humanhash: floor-august-october-gee
File name:8521000125423.exe
Download: download sample
File size:113'664 bytes
First seen:2022-01-05 14:35:46 UTC
Last seen:2022-01-05 17:11:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 3072:iUuWfu8HnN2EMkhyb+KMbrhTyDU4YsTCsl8eCE8Y:iP8t2EXhyV4rByDmmC7eX8
Threatray 1'532 similar samples on MalwareBazaar
TLSH T1EEB30297FBDC4962D43744391C3A23559EE0A409190186EEF8AC854FAFB06F64ED38A9
File icon (PE):PE icon
dhash icon 4b16d7998a60a6a5
Reporter James_inthe_box
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8521000125423.exe
Verdict:
Suspicious activity
Analysis date:
2022-01-05 14:38:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ba85be7c-a4d9-4292-a105-5cf56cdec9b9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/217445/
Detection(s):
SecuriteInfo.com.Trojan.Siggen16.15804.8876.30053.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
clipbanker obfuscated packed
Link:
https://www.filescan.io/uploads/61d5acd592bdc4b4078099a7/reports/2cdc6f60-98df-436e-821a-be559430e296/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/34684fe6-9f5e-41bd-a76e-7583c17fc22f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/915848
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d552f35307e9ce4ea735c7fdddb4bf737463daa68b19b8e02f19a45b3339b928/
Threat name:
ByteCode-MSIL.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2022-01-05 14:35:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
6b10f57d5211fa504775f4db4021b74bfee20d6fc6f908fb062044db926c0656
8f9ff0227f4ce6ed3259d5f2f8bfd8c54496e9896ad5f522cdd768911be4b4bc
c0ccd75375402c9d18d9fd11207ddf17011449874a2bc3521c6e3b815402b578
c314c7feeb98de6391da83678e1639aade3fbe9c95846b8c2f2590ea3d34dd4f
d24cfa0bdad2e8531085b2cf684b9ea333fd5d85daa7c7a51750e943f6ae7e0b
d2d45c33e2a117592e32cc56193c281dcb331281f6024a2eb793c756b4a45d89
e46ea10a5b05bf3eec5a25019a2d41b2a21d236c6bb2be113879d2c765ba7946
e53815bde4306397c668c921b03877403c5faae724ec66e1a62f3cc506fdb2ea
fea660657f6285124e61fe5dcafe9374344d941e6fbeaa89f3a2640572ccc784
+ 1'522 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220105-ryk55aafhp/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
52b6bf08f948c860b7c8edef283ec3e3fb389e104e8a70e702ec947a1b591aea
MD5 hash:
df812828300d8878fdfc75d0b2c201cb
SHA1 hash:
7adcbfa740f17d52b8221eb77863b81780c7ba5f
Link:
https://www.unpac.me/results/76f033a0-3948-4a0f-8890-77d9af8de0ca/
SH256 hash:
bc3336f2b4a4f2b5459ee6add5cfc3dabf5c3ebc37c6b7978b623f9bd470d846
MD5 hash:
015f799b1305b412ae58905a6ce14473
SHA1 hash:
0e208ad4cf61fd83a0eed53b5728203025326a72
Link:
https://www.unpac.me/results/76f033a0-3948-4a0f-8890-77d9af8de0ca/
SH256 hash:
d552f35307e9ce4ea735c7fdddb4bf737463daa68b19b8e02f19a45b3339b928
MD5 hash:
07ff6173347653f4a7c1fcb2551ef2d9
SHA1 hash:
396fd1ba48a89823ede711922ccda47931532d64
Link:
https://www.unpac.me/results/76f033a0-3948-4a0f-8890-77d9af8de0ca/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/d552f35307e9ce4ea735c7fdddb4bf737463daa68b19b8e02f19a45b3339b928

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/217445/
  
URLhaus
https://urlhaus.abuse.ch/url/1951238/

Comments