MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db1d955d0078b3742f10f891b52782101b01a32061cbf250ccdeb1f02beae663. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db1d955d0078b3742f10f891b52782101b01a32061cbf250ccdeb1f02beae663
SHA3-384 hash: 923b80667eba73355bcc1a6f67993746b8e295e809896c0e158285a33e50c39c2342ac7fd66bb1f2595081017846c60b
SHA1 hash: 03488cff850e2ce03c60daaea617198bf228b9cd
MD5 hash: f43a95abda2a482dcb5ffed7ed3eef70
humanhash: pluto-green-monkey-blossom
File name:Danfe2372342.msi
Download: download sample
File size:23'694'336 bytes
First seen:2023-01-17 21:06:43 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 393216:UXOM3rDafPgizvn5b2BBpyKX5I/sqk8BoQLH5+/OoA5KdzyXy:wOMben5b2NT5gsq6QLZIvd
Threatray 16 similar samples on MalwareBazaar
TLSH T1CB37D320937779D9EA27A2FFF0AC5FC48014B5F1A118EA7B73783FA589D054661B6803
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter 0xToxin
Tags:msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
IL IL
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed shell32.dll
Link:
https://www.filescan.io/uploads/63c70df9bda854045c18ffd5/reports/ada6608d-19cb-4d15-b5a1-d4058505f3a9/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/db1d955d0078b3742f10f891b52782101b01a32061cbf250ccdeb1f02beae663
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1153487
Signature
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-01-17 21:12:58 UTC
File Type:
Binary (Archive)
Extracted files:
105
AV detection:
7 of 39 (17.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3mozkxiapczxilyq7ci3kj4ccanqdizamhf7eugm32y7ak7k4zrq._file
Verdict:
unknown
Similar samples:
18e57acc198a3afad96f6fff17a0cc538da02afcba38036dda6cf1b8902efd2b
27b5e52c0c575a9d1a1e460ee54fc4f411fd5783b886854d332253c4ff80c51e
3984f829f5857c513de4b0c89a2e4ccc31e05f19100d575714471d0657b5734d
4296080a2384f70638c544c1a4d598035cb895e7346080960df2413510e0c04a
4f6cb888a4dfade727490683feaee96679d7044f0181799c18a8c7060cb8dab3
7321a205de31cb4c93f10a090316502922d9083dfc076c93903377f36ada3aca
ce41f7c712e0113700f0f3653868200af041f3e170f45dacc6d6e3542ab91062
ffb318a5fd569396377f80259fb3b2ff02ef492efa1922ccbdd1bcdf1f43c162
+ 6 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/230117-zyay6acd21/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Enumerates connected drives
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/db1d955d0078b3742f10f891b52782101b01a32061cbf250ccdeb1f02beae663

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments