MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcae7409025c6d7314b2a15beb5452a4d3ed5d441e3e40726854d193135b8e81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcae7409025c6d7314b2a15beb5452a4d3ed5d441e3e40726854d193135b8e81
SHA3-384 hash: 855a69170fdf7eacb6947340895608705377c21eb66575657db42afb686967156a9a52ca92bcf5ba44846d8ccb54f674
SHA1 hash: 074d572c72321d27bf55c5747902d8f94d6eaa19
MD5 hash: 16ef1f88f6d85b813f4aa7a83d5a0979
humanhash: freddie-beryllium-double-echo
File name:2ndStage.dll
Download: download sample
File size:457'728 bytes
First seen:2023-08-26 06:26:49 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 12288:7B3UoNa7pLrsiarFx602ZEen8Yr4IFoTcQ6+MK:7B3U+wFsiyFc2eL4RTWr
Threatray 14 similar samples on MalwareBazaar
TLSH T15FA402103BE82766DAB69BF259B420114BF571699961E50C0CD790CF2AB2F029F34FB7
TrID 88.8% (.DLL) Generic .NET DLL/Assembly (236632/4/32)
3.9% (.EXE) Win64 Executable (generic) (10523/12/4)
2.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win32 Executable (generic) (4505/5/1)
0.7% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter Securityinbits
Tags:dll


Avatar
Securityinbits
This is 2nd stage .Net dll which was used by line.exe.

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
SG SG
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/444823/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
installutil lolbin packed
Link:
https://www.filescan.io/uploads/64e99b375ec4a8623260f48c/reports/b451aaf9-6c85-4b80-9fd0-06aed628d96a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/dcae7409025c6d7314b2a15beb5452a4d3ed5d441e3e40726854d193135b8e81
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/773efe21-fae8-4c21-9039-7b6809f02380
Result
Threat name:
n/a
Detection:
suspicious
Classification:
evad
Score:
23 / 100
Link:
https://www.joesandbox.com/analysis/1297720
Signature
.NET source code contains potential unpacker
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1297720 Sample: 2ndStage.dll Startdate: 26/08/2023 Architecture: WINDOWS Score: 23 15 .NET source code contains potential unpacker 2->15 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        process5 13 rundll32.exe 9->13         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcae7409025c6d7314b2a15beb5452a4d3ed5d441e3e40726854d193135b8e81/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3sxhiciclrwxgffsufn6wvcsutj62xkedy7ea4tiktizge23r2aq._file
Verdict:
unknown
Similar samples:
2470f5cd9fcdd5fee479668698bb2b5d09e8319caf8ead338a8c776dba14064b
2a22d4d82cd5d187ce6df806f22f93f8dd83619e91595c34332286bbcc4ac7ce
50f3db3dc8ef4ee255514877f5715d26d1838699cf80d057cd046c4ef1ffb6b2
532631b46cb7e5b8b034cb3ef0ecc549fc10856261d9710cf23e7967055ddde4
ad6672b5390661b265f162f695ce7e75d0f8a11bbc9847d04893155219c9c2b5
b72cb2e4f13faeab3a9301367bfef0329f84700344f0ea29836f248004a11d70
dafef03b5ec0d8821003c6e823f7888179a90e2726b34e6242ab24449b37a4d6
e228a849f5375edec8636a1c110c88169d7f8895cfe209eaf7e52d4f22cabeaa
+ 4 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230826-g7rddsad9x/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
dcae7409025c6d7314b2a15beb5452a4d3ed5d441e3e40726854d193135b8e81
MD5 hash:
16ef1f88f6d85b813f4aa7a83d5a0979
SHA1 hash:
074d572c72321d27bf55c5747902d8f94d6eaa19
Link:
https://www.unpac.me/results/dadeb5a5-d74b-43c6-9806-4db4d3f3e9cb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dcae7409025c6d7314b2a15beb5452a4d3ed5d441e3e40726854d193135b8e81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RedLineStealer

zip 3086ac8861aaccdf3dc45f3b1380b6cd70169c7d9fc16f098f5a1d08736fed61

DLL dll dcae7409025c6d7314b2a15beb5452a4d3ed5d441e3e40726854d193135b8e81

(this sample)

DLL dll 65e47578274d16be1be0f50767bad0af16930df43556dd23d7ad5e4adc2bcbe3

  
X
https://twitter.com/Securityinbits/status/1691081404191260674
  
Dropped by
SHA256 3086ac8861aaccdf3dc45f3b1380b6cd70169c7d9fc16f098f5a1d08736fed61
Cape
Cape
https://www.capesandbox.com/analysis/444823/
  
Dropping
SHA256 65e47578274d16be1be0f50767bad0af16930df43556dd23d7ad5e4adc2bcbe3
  
Dropping
MD5 848b847cd19805d19235b5acb8ef2bef
  
Dropped by
MD5 086f03fd9ac1c3c8cfb239ae987e3bd5

Comments