MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9165fe9df95eeb0aa98fa4dbc4aeb718342ebf2728c5fdd86e37cd207143aa3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9165fe9df95eeb0aa98fa4dbc4aeb718342ebf2728c5fdd86e37cd207143aa3
SHA3-384 hash: dec28fdc62a017ef0cd9d13e043bd1662d8cdb73a813665bbc625cfb65b89670b76a3667938fc84a546de284a64b63a0
SHA1 hash: 9f03a404fe64149da2389a7356641227805f929f
MD5 hash: 479444c0e54cf44a2e946ed577060d7c
humanhash: july-utah-one-failed
File name:479444c0e54cf44a2e946ed577060d7c.exe
Download: download sample
File size:47'104 bytes
First seen:2022-11-10 07:58:21 UTC
Last seen:2022-11-10 09:52:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 768:BbWPIUsyhuSDS5PmxxxxxixX0ylUpK9jg+HLr6GbOsKpeQi9c/KYP3hrvGoTr:VwssuSDu306Uk9jg+rr6GbOsKpeQiQKq
Threatray 303 similar samples on MalwareBazaar
TLSH T14E237C40E9849D98DD4AD732A42B8386077B5D46483992EC2FED7CBB5BB33D0251D33A
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon e09a676060678ee0 (14 x AsyncRAT, 5 x ValleyRAT, 4 x Formbook)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
479444c0e54cf44a2e946ed577060d7c.exe
Verdict:
Malicious activity
Analysis date:
2022-11-10 07:59:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/296d372d-f535-4161-a472-e7cc86ccb43e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/331775/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1660.5039.1551.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Sending an HTTP GET request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/636caf475ae98d577068a849/reports/971a25b9-14dc-4f53-a21a-c54bd49c1a44/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/bb154732-d4bb-49ae-b281-26be7d3b39a8
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1110155
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9165fe9df95eeb0aa98fa4dbc4aeb718342ebf2728c5fdd86e37cd207143aa3/
Threat name:
ByteCode-MSIL.Downloader.Wagex
Create hunting rule
Status:
Malicious
First seen:
2022-11-10 05:58:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
14 of 26 (53.85%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3elf72o7sxxlbkuy7jg3ysxlogbuf27sokgf7xmg4n6nebyuhkrq._file
Verdict:
unknown
Similar samples:
1b79570c79f25ae18f75eef6156511ee39cf27c00382c9d2d0e359febc4aefad
7ca44e6eee2fd56c406711959a6a9a2e8804b4cdd7f929263dd5b0ce62f2a5ec
8065a613ba2ec14ed040b4440ffb21b767b3aedfcfb21ef283ae29a2479f76f8
af880994009ae32acf2ac7f09f2c7ce28abe8aa20580ef6d5248690698601077
be123de6d4152bff7260ecdb9cf106f359b04a900f6c25a8e8c99b999442f2a9
be2376df70f906624766571ed4d763fcf2d9f869c4d3435d792179ecf8c246c1
+ 293 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/221110-jvdmwahhcj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5ffe95d4-7533-4b78-830d-cef517df4ae6
Unpacked files
SH256 hash:
d9165fe9df95eeb0aa98fa4dbc4aeb718342ebf2728c5fdd86e37cd207143aa3
MD5 hash:
479444c0e54cf44a2e946ed577060d7c
SHA1 hash:
9f03a404fe64149da2389a7356641227805f929f
Link:
https://www.unpac.me/results/f3f06fc6-a3a9-4c4e-ade7-1dd46f69d427/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d9165fe9df95eeb0aa98fa4dbc4aeb718342ebf2728c5fdd86e37cd207143aa3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WhisperGateStage2
Create hunting rule
Author:Harish Kumar
Description:Yara Rule to Detect WhisperGateStage2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe d9165fe9df95eeb0aa98fa4dbc4aeb718342ebf2728c5fdd86e37cd207143aa3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2229648/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/331775/

Comments