MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d655793a58b3a4b90a22bf84b775305ca1834b9f57432bdf5f48bd505b46fd4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	d655793a58b3a4b90a22bf84b775305ca1834b9f57432bdf5f48bd505b46fd4f
SHA3-384 hash:	1d9085978de9fabcc9aedd3e7da3f3211cbea6b2945890b9660a454b3f981157c20d49df5f0588c517686ebf570924c4
SHA1 hash:	867f8d94b736a10e2c68245cd1d692843b319a37
MD5 hash:	002b31fa3fac0fe48ad615182c272eaa
humanhash:	early-rugby-black-golf
File name:	S O A.zip
Download:	download sample
File size:	8'794 bytes
First seen:	2023-02-01 10:52:38 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	192:/MwHKzT4j8UMkKf15qD1DrKmlWbLE70dEphap1IZg:/MwqnUptAc0dsa8Zg
TLSH	T15902C0C4CB430E09D493E3E6DBE2D9AE8A23A4E1FC429D25BD1353EE048119EB0FD904
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	zip

cocaman

Malicious email (T1566.001)
From: "Purchase Manager<info@alsondosegy.com>" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.136]) "
Date: "1 Feb 2023 05:10:24 +0100"
Subject: "RE:STATEMENT OF ACCOUNT"
Attachment: "S O A.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	S O A.exe
File size:	18'432 bytes
SHA256 hash:	1ea7b6f180cc035a9bba3b7e637ecaad82fca366151046e3c5f8f3aa041c64c5
MD5 hash:	dc7f46e2ae5f604cc6ac4a6dfe596423
MIME type:	application/x-dosexec

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_fs3119.UNOFFICIAL

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/d655793a58b3a4b90a22bf84b775305ca1834b9f57432bdf5f48bd505b46fd4f/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

kryptocibule

Link:

https://www.filescan.io/uploads/63da449189bd67c10fdbfe14/reports/cd4c8ef8-5001-472f-a98a-fc9f7ac78dbb/overview

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/d655793a58b3a4b90a22bf84b775305ca1834b9f57432bdf5f48bd505b46fd4f

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d655793a58b3a4b90a22bf84b775305ca1834b9f57432bdf5f48bd505b46fd4f/

Threat name:

Win64.Trojan.Pwsx

Status:

Malicious

First seen:

2023-02-01 05:35:39 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 38 (42.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2zkxsosywoslscrcx6clo5jqlsqygs47k5bsxx27jc6vaw2g7vhq._file

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/230201-ncj46ada39/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/d655793a58b3a4b90a22bf84b775305ca1834b9f57432bdf5f48bd505b46fd4f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.