MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9811e872a9ca7c1677b003630980c86079da627723497363920e7870d103246. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9811e872a9ca7c1677b003630980c86079da627723497363920e7870d103246
SHA3-384 hash: ce138dc784a532264ace9a3e5715ea3c29a1b342abd67ca148c3d8715b3b2dc7ee61971d0fc66062f01d1bcaa0a7fff8
SHA1 hash: c0fef342d4398cb7656c4723e7e4f88341aa3996
MD5 hash: 3b65e95f9a43b837254ca66788eb0bc3
humanhash: bakerloo-arizona-yankee-bacon
File name:CAMSCANNER-1805.2023.exe
Download: download sample
File size:1'252'184 bytes
First seen:2023-05-19 09:35:06 UTC
Last seen:2023-05-20 14:54:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:Pe2EyN+Mm/A5uWjTdnWY8Xw3R7aw5+V3E00KfLZvHrIKX2uc7htL9U8pVThyvdlw:PiWd/Lb+3B2McisHy759/yOwZoc
Threatray 1'444 similar samples on MalwareBazaar
TLSH T12745483439FA501AB173EFAA8BE879AADA6FB7733B07645D1050038A4723941DEC153D
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter lowmal3
Tags:exe signed

Code Signing Certificate

Organisation:bake
Issuer:bake
Algorithm:sha256WithRSAEncryption
Valid from:2023-05-18T07:35:22Z
Valid to:2024-05-18T07:35:22Z
Serial number: 5a6a37d988ee68541a34a011da265d07
Thumbprint Algorithm:SHA256
Thumbprint: 6d4183f9417d4a401f8d47e9cc6425c848ca12918b3fff359720fa12596fed45
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
238
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CAMSCANNER-1805.2023.exe
Verdict:
Malicious activity
Analysis date:
2023-05-19 09:35:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d3832542-f5e9-42f7-a4f6-0feb20eb35bc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Barys.337972.23129.9313.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Creating a file
Sending a custom TCP request
Launching a process
Creating a process from a recently created file
Creating a service
Loading a system driver
Changing a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Enabling autorun for a service
Blocking the User Account Control
Forced shutdown of a system process
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin overlay packed
Link:
https://www.filescan.io/uploads/646743034a9e063828bee28f/reports/0c8270a0-9a8b-4e47-a09b-c8a59df19b8f/overview
Verdict:
Malicious
Labled as:
Barys.Generic
Link:
https://www.hybrid-analysis.com/sample/d9811e872a9ca7c1677b003630980c86079da627723497363920e7870d103246
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/abdc0e46-5040-4589-a70f-7bdfcbc42be3
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1237024
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Disables UAC (registry)
Drops PE files with benign system names
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample is not signed and drops a device driver
Sigma detected: Schedule system process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 870019 Sample: CAMSCANNER-1805.2023.exe Startdate: 19/05/2023 Architecture: WINDOWS Score: 100 60 www.estherxpena.com 2->60 64 Malicious sample detected (through community Yara rule) 2->64 66 Antivirus / Scanner detection for submitted sample 2->66 68 Multi AV Scanner detection for submitted file 2->68 70 8 other signatures 2->70 10 CAMSCANNER-1805.2023.exe 1 7 2->10         started        14 svchost.exe 3 2->14         started        16 svchost.exe 5 2->16         started        18 svchost.exe 2->18         started        signatures3 process4 file5 50 C:\Users\user\AppData\Roaming\svchost.exe, PE32+ 10->50 dropped 52 C:\Users\...\CAMSCANNER-1805.2023.exe.log, CSV 10->52 dropped 74 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->74 76 Drops PE files with benign system names 10->76 20 cmd.exe 1 10->20         started        22 cmd.exe 1 10->22         started        78 Antivirus detection for dropped file 14->78 80 Multi AV Scanner detection for dropped file 14->80 82 Machine Learning detection for dropped file 14->82 84 Adds a directory exclusion to Windows Defender 14->84 54 C:\Windows\Temp\peujbolu.inf, Windows 16->54 dropped 86 Writes to foreign memory regions 16->86 88 Injects a PE file into a foreign processes 16->88 25 cmstp.exe 16->25         started        56 C:\Windows\Temp\zetwmm2c.inf, Windows 18->56 dropped signatures6 process7 dnsIp8 28 svchost.exe 5 4 20->28         started        32 conhost.exe 20->32         started        34 timeout.exe 1 20->34         started        72 Uses schtasks.exe or at.exe to add and modify task schedules 22->72 36 conhost.exe 22->36         started        38 schtasks.exe 1 22->38         started        62 192.168.2.1 unknown unknown 25->62 signatures9 process10 file11 58 C:\Users\user\AppData\Local\Temp\?????.sys, PE32+ 28->58 dropped 90 Adds a directory exclusion to Windows Defender 28->90 92 Disables UAC (registry) 28->92 94 Sample is not signed and drops a device driver 28->94 40 powershell.exe 28->40         started        42 AddInUtil.exe 28->42         started        44 EdmGen.exe 28->44         started        46 29 other processes 28->46 signatures12 process13 process14 48 conhost.exe 40->48         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9811e872a9ca7c1677b003630980c86079da627723497363920e7870d103246/
Threat name:
Win64.Trojan.Barys
Create hunting rule
Status:
Malicious
First seen:
2023-05-18 14:59:01 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
2
AV detection:
19 of 36 (52.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3gar5bzktst4cz33aa3dbgamqydz3jrhoi2jonrzedtyodiqgjda._file
Verdict:
malicious
Similar samples:
2267fac6e4bcace94d9ed232cc4ba7e128424e80c5730ea38f23610c11bdc168
28ff484ca36b3a1f5d7f59a25e947e9a6b12ca34214f9bcfca01cee5745e6b6a
34a6cb7776062b6a981d8f2b1fd7e6e7fc6fb9c5253f57a06cef1903569fd532
36f8d4d85b7d03fdbd622909d93638fa20bbdcc1e832591b82dbe7f710ab0be0
6159a8ba420cbed9d0ca9abb371cd8b1e600c0e2fd7763f32cec6917605d51d9
9ef8d74a3ef84feb99d45e04e084fb628c091f8fa3b81b42faacc235ab2e753e
ab08b3b1fe0ef92d0f112ab2d85303ce7cb12f1c06cda7e288c403e6d9c6312e
d69974ab2591e06f55c58786be3fc436fe992c501dd37724869747e2369c909d
f3a73a547e9298562234af0d04a47fe50dd1d6481671e4a5df65e568e89f2c00
fb8fdb08cf7984a3bac0cc7daeea3790a92306467543cf556945fc479a165dd8
+ 1'434 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan
Link:
https://tria.ge/reports/230519-lke43afh8y/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Uses Task Scheduler COM API
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Maps connected drives based on registry
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Uses the VBS compiler for execution
Windows security modification
Looks for VMWare Tools registry key
Sets service image path in registry
Looks for VirtualBox Guest Additions in registry
UAC bypass
Windows security bypass
Unpacked files
SH256 hash:
d9811e872a9ca7c1677b003630980c86079da627723497363920e7870d103246
MD5 hash:
3b65e95f9a43b837254ca66788eb0bc3
SHA1 hash:
c0fef342d4398cb7656c4723e7e4f88341aa3996
Link:
https://www.unpac.me/results/27ee1766-b450-4ee8-a0ab-5cff0acd6d15/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d9811e872a9c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d9811e872a9ca7c1677b003630980c86079da627723497363920e7870d103246

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments