MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8c3bca20c7dc652b2d760a48ee342e5fade3c1ff57b29622686c33a4b2d1041. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8c3bca20c7dc652b2d760a48ee342e5fade3c1ff57b29622686c33a4b2d1041
SHA3-384 hash: c49068262885233548c4d74a1a782f596bfd268a6d48ef9ed36236548a9d177bdcb9fab12719d42e7d19d92672b5c9bb
SHA1 hash: 3aadb53d1b3ad4eda82c67ead6363366f57c9396
MD5 hash: 2910b2a8c6fb5690ac4eee6c8e586628
humanhash: timing-johnny-seven-jupiter
File name:2910b2a8c6fb5690ac4eee6c8e586628.exe
Download: download sample
File size:272'896 bytes
First seen:2022-12-07 12:05:27 UTC
Last seen:2022-12-07 13:38:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 50d8a4762b09f148cecbce7073cf1ef4
ssdeep 6144:A7uHfH9Jnd0/Z6oir1jLzA4tmXgOU9+S:yuHv9y6TrFvuS
TLSH T11C447BCCB4DA44B9C4325D3ECDF6B9DC8768A7600A34571FA77D0B781AB014C66A26E3
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2910b2a8c6fb5690ac4eee6c8e586628.exe
Verdict:
No threats detected
Analysis date:
2022-12-07 12:14:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7f9e7205-efc4-46f1-8884-b9898eff42b4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/343910/
Detection(s):
SecuriteInfo.com.Trojan.Siggen19.16009.6581.521.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Launching a process
Downloading the file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed rat shell32.dll
Link:
https://www.filescan.io/uploads/639081ae55eb3470cd4fe95f/reports/2b3488f1-d1de-4bd8-8dc8-9b6cc4749884/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/499e9ad2-1477-4e0f-b541-50295abc4d4c
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1129859
Signature
Antivirus detection for URL or domain
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Sigma detected: Powershell Download and Execute IEX
Uses ping.exe to check the status of other devices and networks
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 762583 Sample: VBvBMbncnv.exe Startdate: 07/12/2022 Architecture: WINDOWS Score: 76 35 Antivirus detection for URL or domain 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 Sigma detected: Powershell Download and Execute IEX 2->39 41 Machine Learning detection for sample 2->41 7 VBvBMbncnv.exe 13 2->7         started        process3 dnsIp4 33 cetakdisini.com 117.103.66.75, 443, 49695, 49696 JURAGAN-AS-IDPTSuryaGlobalTeknologiID Indonesia 7->33 43 Self deletion via cmd or bat file 7->43 11 cmd.exe 1 7->11         started        14 cmd.exe 1 7->14         started        signatures5 process6 signatures7 45 Uses ping.exe to check the status of other devices and networks 11->45 16 PING.EXE 1 11->16         started        19 conhost.exe 11->19         started        21 powershell.exe 14 16 14->21         started        23 conhost.exe 14->23         started        process8 dnsIp9 25 127.0.0.1 unknown unknown 16->25 27 192.168.2.1 unknown unknown 16->27 29 cetakdisini.com 21->29 31 45.90.59.123, 49699, 80 GREENFLOID-ASUA Bulgaria 21->31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8c3bca20c7dc652b2d760a48ee342e5fade3c1ff57b29622686c33a4b2d1041/
Threat name:
Win32.Trojan.PsDownload
Create hunting rule
Status:
Malicious
First seen:
2022-11-29 16:17:42 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3db3ziqmpxdffmwxmcsi5y2c4x5n4pa76v5ssyrgq3btuszncbaq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/221207-n9rkhaef69/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Deletes itself
Blocklisted process makes network request
Malware Config
Dropper Extraction:
https://cetakdisini.com/wp-content/config_20.ps1
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e6cf7870-3fd4-4dc3-b57e-749b1ef06350
Unpacked files
SH256 hash:
d8c3bca20c7dc652b2d760a48ee342e5fade3c1ff57b29622686c33a4b2d1041
MD5 hash:
2910b2a8c6fb5690ac4eee6c8e586628
SHA1 hash:
3aadb53d1b3ad4eda82c67ead6363366f57c9396
Link:
https://www.unpac.me/results/6264cae7-8b0b-43cc-8923-7b89a0f97d6b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d8c3bca20c7dc652b2d760a48ee342e5fade3c1ff57b29622686c33a4b2d1041

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe d8c3bca20c7dc652b2d760a48ee342e5fade3c1ff57b29622686c33a4b2d1041

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2447818/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/343910/

Comments