MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 decfaad9816261d3eba76b67c8965ddce1fc2192e039b62e43b297b25650b4cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Intelligence 11 IOCs YARA 10 File information Comments 1

SHA256 hash:	decfaad9816261d3eba76b67c8965ddce1fc2192e039b62e43b297b25650b4cc
SHA3-384 hash:	843115d2d2ef076104c78498c4d9e0cf6f4a4f1571ff05cd5ee1eebe27164c40acfd338e6b34428a57d5f5d64aa5b88a
SHA1 hash:	111bd6551cab8aca9f28826226e558605b9b15e5
MD5 hash:	3b21f73a9c40384708e262cbe2dc5497
humanhash:	diet-november-violet-oxygen
File name:	3b21f73a9c40384708e262cbe2dc5497
Download:	download sample
File size:	6'421'040 bytes
First seen:	2024-01-08 10:17:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	643742a9c032e6f352b79ebb8abbeecf
ssdeep	98304:4qZZJvEF+Qa30fIDYLlFOvg17rtbiScWrxJG8+22nbtoyeNtWBkchm+r8:VLAzbfIEe2xgp8lc5oyeNIecp8
TLSH	T1A556338648EF318CD89E3A391672BFDC7B75BBB201300A6EE52125BB1DB3D512875712
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4505/5/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	zbetcheckin
Tags:	32 exe

Intelligence

File Origin

# of uploads :

# of downloads :

396

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/469857/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Searching for analyzing tools

Сreating synchronization primitives

Creating a file

Creating a file in the %temp% directory

Enabling the 'hidden' option for recently created files

Running batch commands

Creating a process with a hidden window

Launching a process

Creating a process from a recently created file

Sending a custom TCP request

Connecting to a non-recommended domain

Sending an HTTP GET request

Creating a window

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin overlay packed packed shell32 themidawinlicense vmprotect

Link:

https://www.filescan.io/uploads/659bcbde99da41ccd7ca98a3/reports/33ebba7c-c2fd-4d05-a6be-471d0bea8ce7/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/decfaad9816261d3eba76b67c8965ddce1fc2192e039b62e43b297b25650b4cc

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/59617b31-b83d-4a79-a317-7ff07a68e029

Result

Threat name:

MicroClip

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1371153

Signature

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Yara detected MicroClip

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/decfaad9816261d3eba76b67c8965ddce1fc2192e039b62e43b297b25650b4cc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/decfaad9816261d3eba76b67c8965ddce1fc2192e039b62e43b297b25650b4cc/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2024-01-08 10:18:08 UTC

AV detection:

18 of 24 (75.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=33h2vwmbmjq5h25hnnt4rfs53tq7yims4a43mlsdwkl3evsqwtga._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

9/10

Tags:

evasion themida trojan

Link:

https://tria.ge/reports/240108-mbyeqafgej/

Behaviour

Creates scheduled task(s)

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Themida packer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Unpacked files

SH256 hash:

e19ae26f9e79056c60103ab256adaebb6a8b80a522aac67f03a3c4c8dd44531e

MD5 hash:

87d1b6bd873e354c22004fa4af6e9419

SHA1 hash:

19b65229bb3e429eeea0a325d29a710979f303f2

Link:

https://www.unpac.me/results/826dd419-4aec-4645-97e1-571bbd70ddaf/

SH256 hash:

decfaad9816261d3eba76b67c8965ddce1fc2192e039b62e43b297b25650b4cc

MD5 hash:

3b21f73a9c40384708e262cbe2dc5497

SHA1 hash:

111bd6551cab8aca9f28826226e558605b9b15e5

Detections:

INDICATOR_EXE_Packed_Themida

Link:

https://www.unpac.me/results/826dd419-4aec-4645-97e1-571bbd70ddaf/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/decfaad9816261d3eba76b67c8965ddce1fc2192e039b62e43b297b25650b4cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe decfaad9816261d3eba76b67c8965ddce1fc2192e039b62e43b297b25650b4cc

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2735404/

URLhaus

https://urlhaus.abuse.ch/url/2737076/

URLhaus

https://urlhaus.abuse.ch/url/2742874/

URLhaus

https://urlhaus.abuse.ch/url/2739592/

URLhaus

https://urlhaus.abuse.ch/url/2733619/

Cape

https://www.capesandbox.com/analysis/469857/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-01-08 10:17:11 UTC

url : hxxp://185.172.128.8/cp.exe