MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcb1145f599d5d198923781c0752a2c9c5906064138dab0f532fee5ab1e9aaf7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcb1145f599d5d198923781c0752a2c9c5906064138dab0f532fee5ab1e9aaf7
SHA3-384 hash: f1d3d5f82aefce6acc892883933ea02260248ca185abc44dc961efb9d9890fd9f8cd6c3449e9939bf72d473973b139a6
SHA1 hash: 00cc190ed93f0effbfc2ed9674f5365148bfaab4
MD5 hash: 499f2141ce7e65de9cf81370aa2e31c6
humanhash: oranges-virginia-johnny-sodium
File name:dcb1145f599d5d198923781c0752a2c9c5906064138dab0f532fee5ab1e9aaf7
Download: download sample
File size:39'360 bytes
First seen:2021-11-16 11:31:03 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash ab08e4629a75b80e4430d16f744bf656 (1 x Heodo)
ssdeep 768:bVt+iRrYS51RNM7Odcse/bqvV3ugE7skOTmYsT4dzQJX3ske+coB:KiRrY6R27OdWo9ugEfShvNS
Threatray 202 similar samples on MalwareBazaar
TLSH T19A038E56611828E3D989177828E62B3F8E50FB23EED56071A0D0D5CBD98AFC31BCC765
Reporter JAMESWT_WT
Tags:dll POLE CLEAN LTD

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/206396/
Detection(s):
SecuriteInfo.com.Variant.Bulz.774921.21567.1975.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger overlay packed
Link:
https://www.filescan.io/uploads/619396b543e8f62b66953b40/reports/271c05e9-377d-40ad-9430-a9bd0a7d821d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a9e41cde-a34d-4187-9bfd-833593e610d4
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/890311
Signature
Antivirus detection for URL or domain
Found C&C like URL pattern
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 522784 Sample: eUlQKfH2IN Startdate: 16/11/2021 Architecture: WINDOWS Score: 92 51 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->51 53 Antivirus detection for URL or domain 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 3 other signatures 2->57 9 loaddll32.exe 1 2->9         started        11 powershell.exe 18 2->11         started        process3 process4 13 cmd.exe 1 9->13         started        15 rundll32.exe 9->15         started        18 rundll32.exe 9->18         started        20 conhost.exe 11->20         started        22 Get-Variable.exe 11->22         started        signatures5 24 rundll32.exe 1 13->24         started        59 System process connects to network (likely due to code injection or exploit) 15->59 28 service.eXE 15->28         started        process6 dnsIp7 43 107.173.81.145, 49766, 49767, 49783 AS-COLOCROSSINGUS United States 24->43 39 C:\ProgramData\service.eXE, PE32 24->39 dropped 30 service.eXE 14 24->30         started        file8 process9 dnsIp10 45 188.130.139.47, 49784, 49785, 49788 ASKONTELRU Russian Federation 30->45 41 C:\Users\user\AppData\...behaviorgraphet-Variable.exe, PE32 30->41 dropped 47 Uses schtasks.exe or at.exe to add and modify task schedules 30->47 49 Hides that the sample has been downloaded from the Internet (zone.identifier) 30->49 35 Get-Variable.exe 14 30->35         started        37 schtasks.exe 30->37         started        file11 signatures12 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcb1145f599d5d198923781c0752a2c9c5906064138dab0f532fee5ab1e9aaf7/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2021-11-15 21:17:22 UTC
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3syrix2ztvortcjdpaoaouvczhczaydecog2wd2tf7xfvmpjvl3q._file
Verdict:
malicious
Similar samples:
1b6893887051e9bb3155b6a817e71e499dcb5959369391a42b772c0fa75e55fd
4d52f61961a8e584db24d2162cdcd12781bc4f63e32171964a51410421108401
6b74dc043f9a12823ed98d704e4c8543c9b5d8b9240e65e9d31d2303ab914906
785968cadb71152d2005691e064aeabd29136be4abff0ee932529110e319053e
7c964794e19b093b78a81da3b8dcafbe3d32153a044c19f6892829ed9ff71f46
851b9e416b22c80a435f7d11f0298272ad23a4ae49f6fbe23aafa0578c400bd0
a334885a72d65b2920f247d4a15de104e1b020713f08964316e566d8323bd474
d36674d4c3214e0b0560c6e172bb1765e085892959472afdda2f1debda84ca9d
f5fd02ebd2376fd1bc1ff121e9bfda618755a5c049edc8a4288eb67eb1cc7f9b
+ 192 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/211116-nmrlzsdeg6/
Behaviour
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Unpacked files
SH256 hash:
dcb1145f599d5d198923781c0752a2c9c5906064138dab0f532fee5ab1e9aaf7
MD5 hash:
499f2141ce7e65de9cf81370aa2e31c6
SHA1 hash:
00cc190ed93f0effbfc2ed9674f5365148bfaab4
Link:
https://www.unpac.me/results/3c35c52d-897b-4e08-8379-21e18aff572b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dcb1145f599d5d198923781c0752a2c9c5906064138dab0f532fee5ab1e9aaf7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/206396/

Comments