MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d8f2fda07b89045e5be74831d2bcba51e70a3d918416ed7aae1ed0351f94e3a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SoranoStealer
Vendor detections: 11
| SHA256 hash: | d8f2fda07b89045e5be74831d2bcba51e70a3d918416ed7aae1ed0351f94e3a7 |
|---|---|
| SHA3-384 hash: | e72dc1e5647d2475b535f101243f7fd742a8abf41047c600acbc4c0bf10c59fbd601672e0277ad8ed339334ea578bca9 |
| SHA1 hash: | 6ed54b09f1b43923505700c5ae1de4eeed1d39f8 |
| MD5 hash: | 3f79ad2fe372116f5d14e0853436fc13 |
| humanhash: | three-equal-fillet-nevada |
| File name: | Obfuscated Name.exe |
| Download: | download sample |
| Signature | SoranoStealer |
| File size: | 4'683'264 bytes |
| First seen: | 2022-07-05 11:13:03 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'751 x AgentTesla, 19'657 x Formbook, 12'248 x SnakeKeylogger) |
| ssdeep | 98304:CQf3s64R9ybzUcwti78OqJ7TPBF3ZlHHgkWJ0P39qXSaDv:jzUcwti7TQlF3ZxxWJSUnDv |
| Threatray | 1'095 similar samples on MalwareBazaar |
| TLSH | T1C6261242F3D28072E4BA267056B7573689B9BE115331DAC79BC06C49ADB17F0AE39343 |
| TrID | 31.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 18.5% (.EXE) InstallShield setup (43053/19/16) 11.6% (.EXE) UPX compressed Win32 Executable (27066/9/6) 11.4% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 7.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) |
| Reporter |  JaffaCakes118 |
| Tags: | exe SoranoStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
232
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Obfuscated Name.exe
Verdict:
Malicious activity
Analysis date:
2022-07-05 11:11:21 UTC
Tags:
installer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
Sending a custom TCP request
DNS request
Creating a window
Running batch commands
Creating a process with a hidden window
Reading critical registry keys
Changing a file
Unauthorized injection to a recently created process
Stealing user critical data
Verdict:
Malicious
Threat level:
10/10
Confidence:
80%
Tags:
anti-vm cmd.exe dllhost.exe evasive fingerprint hh.exe packed shell32.dll tiny virus xwizard.exe
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Mispadu
Verdict:
Malicious
Result
Threat name:
Hog Grabber
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected BrowsingHistoryView browser history reader tool
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Yara detected Hog Grabber
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Infostealer.HEURDisco
Status:
Malicious
First seen:
2022-07-05 11:14:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
180
AV detection:
30 of 39 (76.92%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 1'085 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
spyware stealer upx
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
UPX packed file
NirSoft WebBrowserPassView
Nirsoft
Unpacked files
SH256 hash:
57ed3a8b06c3ee40450d175eae8058edd164c20e95644614cc497cefdea01a00
MD5 hash:
8a5e8bb8e0caad41d88c75223009f110
SHA1 hash:
cddad5b3b761f8a6762b9ba6e5a5526d49c91339
SH256 hash:
6f658d8e3f82c44f2418b430e34fbd15232d0fcb2a48973d13f22f77265b1ec5
MD5 hash:
73da9309aa898edfbef4b25b5d1b8fb5
SHA1 hash:
0aef5387f8cf4094c1ec95e5c43d80942e6f8fc8
SH256 hash:
d8f2fda07b89045e5be74831d2bcba51e70a3d918416ed7aae1ed0351f94e3a7
MD5 hash:
3f79ad2fe372116f5d14e0853436fc13
SHA1 hash:
6ed54b09f1b43923505700c5ae1de4eeed1d39f8
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_EXE_Packed_Fody |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables manipulated with Fody |
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables embedding registry key / value combination indicative of disabling Windows Defedner features |
| Rule name: | INDICATOR_TOOL_ChromeCookiesView |
|---|---|
| Author: | ditekSHen |
| Description: | Detects ChromeCookiesView |
| Rule name: | INDICATOR_TOOL_EdgeCookiesView |
|---|---|
| Author: | ditekSHen |
| Description: | Detects EdgeCookiesView |
| Rule name: | MALWARE_Win_SoranoStealer |
|---|---|
| Author: | ditekSHen |
| Description: | Detects SoranoStealer / HogGrabber. Available on Github: /Alexuiop1337/SoranoStealer |
| Rule name: | MAL_Lokibot_Stealer |
|---|---|
| Description: | Detects Lokibot Stealer Variants |
| Rule name: | pdb_YARAify |
|---|---|
| Author: | @wowabiy314 |
| Description: | PDB |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.