MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7b59654644c399eaf13d7460b928ebf8f94bfd9e97e4a135ef005719e4eb18b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7b59654644c399eaf13d7460b928ebf8f94bfd9e97e4a135ef005719e4eb18b
SHA3-384 hash: bd42e912c71c41a97c19690cea0a3c1beaf775c1474d7c5a9d6a3ca3e1405a33ad944e2720037b91b570ef0e74bb4ab8
SHA1 hash: ba86b54e102d93530585aff6d1b1b32f48a779da
MD5 hash: 308de8340d361aab35f1828655849723
humanhash: dakota-maryland-princess-december
File name:Payment Invoice.pdf.exe
Download: download sample
File size:63'488 bytes
First seen:2021-05-04 06:09:58 UTC
Last seen:2021-05-04 07:07:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 768:YaIrJiEPZ5myd6Ol+3rQ/wD0AIh8L2KfPtZEKzF3x:YaIrt5myd9+Y7hqHPHzJx
Threatray 21 similar samples on MalwareBazaar
TLSH 3753400DE1E45138F5EB8FBDCFE391E50A4CF7F0AA320179212A5F19BE41E968952271
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/149712/
Detection(s):
SecuriteInfo.com.Variant.Barys.8211.15628.7614.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Sending an HTTP GET request
Sending a UDP request
Unauthorized injection to a recently created process
Enabling the 'hidden' option for analyzed file
Creating a file
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/709300
Signature
Antivirus detection for dropped file
Connects to a pastebin service (likely for C&C)
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses an obfuscated file name to hide its real file extension (double extension)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7b59654644c399eaf13d7460b928ebf8f94bfd9e97e4a135ef005719e4eb18b/
Threat name:
ByteCode-MSIL.Trojan.Barys
Create hunting rule
Status:
Malicious
First seen:
2021-05-04 02:55:17 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=262zmvdejq4z5lyt25daxeuox6hzjp6z5f7eue266acxdhsowgfq._file
Verdict:
malicious
Similar samples:
07cf6baf41520d0e97f2010bf76c2ed10509fbf599209ae4bc250eb375515114
23cfbb0bf1e110a79678f45c29897e6090b660d3df420bbb916fc3f1bc12eead
268953af63bad4895dd06c024fd1ec2af2c134623a0e100e26894e4d6bab741e
6269fd417f93e7c0d7cab576b35dc3b6f6a58c0f04e75533bad84987c228f0e6
75fa551eec71d6d8b9817266813715c2bbb7a537005587f9f1e0d058a05febc6
7faef4d80d1100c3a233548473d4dd7d5bb570dd83e8d6e5faff509d6726baf2
8ae8b54bc449ebeb94ba2ad9e0fe136404dec237f612459282ef465e5df59160
9de62b6a25946e88979452c0d81b0d91e3d8e6427e9c25f11890c2aa1fe05f01
de1ed5da43cf003b1d30009c1601a722ba1c904e412b95ad1dfdd2ca5cef3021
e7d2deba4fccbea79ffa209ebe0ce49f98aecfb340c8d6ec3ea1773cb12cb07e
+ 11 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/210504-aqgzkzmyz6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
d7b59654644c399eaf13d7460b928ebf8f94bfd9e97e4a135ef005719e4eb18b
MD5 hash:
308de8340d361aab35f1828655849723
SHA1 hash:
ba86b54e102d93530585aff6d1b1b32f48a779da
Link:
https://www.unpac.me/results/e00e80b1-a71e-4a23-9576-dcda87bbb52f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Barys
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d7b59654644c399eaf13d7460b928ebf8f94bfd9e97e4a135ef005719e4eb18b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
Create hunting rule
Author:ditekSHen
Description:Detects executables containing URLs to raw contents of a paste
Rule name:pe_imphash
Create hunting rule
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Unknown_Malware_Sample_Jul17_2
Create hunting rule
Author:Florian Roth
Description:Detects unknown malware sample with pastebin RAW URL
Reference:https://goo.gl/iqH8CK

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/149712/

Comments