MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df4bcbb9191dc0a5facbed23dc30584d7d1c7532d4dee8e82edc810141f98971. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df4bcbb9191dc0a5facbed23dc30584d7d1c7532d4dee8e82edc810141f98971
SHA3-384 hash: 2a161051c18c437a26d3f59fbac18e39dc4998281ff27829b596ab9288799fe5a0c22e6af0d8ee2788b33d42566964bd
SHA1 hash: b2246a32311a55c8d6d13e16d224543943ef4660
MD5 hash: de06ad9c5df553731e863bee6151bc5b
humanhash: may-apart-connecticut-delta
File name:de06ad9c5df553731e863bee6151bc5b.exe
Download: download sample
File size:2'687'066 bytes
First seen:2022-02-10 18:57:42 UTC
Last seen:2022-02-10 20:56:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9d1f0da408c33eebb70b9bfa17b7fddc (4 x njrat, 1 x Jadtre)
ssdeep 49152:toX3yq8XDY2Td2l+xysLqmiuUyKFAMkq9xraNSNzHznVxLgKGX:toHyq6d2UlcAcTrIS1TnV6BX
Threatray 298 similar samples on MalwareBazaar
TLSH T190C5235177C4E0B3C1036031484A8E32F63DF476A92651867BCA6F397E36AD9DB3A706
File icon (PE):PE icon
dhash icon cdabae6fe6e7eaec (20 x Amadey, 9 x AurotunStealer, 8 x CoinMiner)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
242
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/240736/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.21854.16546.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
coinminer greyware overlay packed setupapi.dll shdocvw.dll shell32.dll update.exe xtreme
Link:
https://www.filescan.io/uploads/6205605345ddfa2e18bcaf24/reports/44dfe533-a7ed-4157-afdc-0c7663f9a923/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/221c2d00-ff09-4814-9ca3-491a29c4458b
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
6 / 100
Link:
https://www.joesandbox.com/analysis/937915
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df4bcbb9191dc0a5facbed23dc30584d7d1c7532d4dee8e82edc810141f98971/
Verdict:
unknown
Similar samples:
2534eecca5ed157444298473d7c9c82d9def5b0a93ac581b75dede2f1a0c0a56
3494fdebd477fb45b537334f415f6e7b56ad7aa2764f80472ee7cb705d30eb65
37f2acf9034604a386575450898379fe0ff15368273bea17c9f527ff5d9bab08
4d4b219a3788d8e40bd7083d421e3d7d399a065bd53afb6e74d3fb7ab2bc09bd
7097b016e2aead3d213343e1de7332fddc4d83e2e8c2f8329460738cb2dbea4d
79ffbaa84a7808f62c8d2453e7e7ad96312da7e7b2e0b62c02d38f4de75eb3ca
7e7fd605de6d3d6aa4dc413baa57e8045470e809cf5fd61b80b4b3c51ee39ce9
9e2bea46ed015f98e1fb7591e83f1cac52c51f5e3f004cc6a57c508dcef134e0
d13edbb9da20126b75fd6f0d3c402fddcafdca90f81fd875b96a88c0028c431d
+ 288 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/220210-xmg7zsagbj/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
Unpacked files
SH256 hash:
df4bcbb9191dc0a5facbed23dc30584d7d1c7532d4dee8e82edc810141f98971
MD5 hash:
de06ad9c5df553731e863bee6151bc5b
SHA1 hash:
b2246a32311a55c8d6d13e16d224543943ef4660
Link:
https://www.unpac.me/results/7e3ee3e2-7378-4222-926c-fe6a94e2f9ec/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exec_macros
Create hunting rule
Author:ddvvmmzz
Description:exec macros

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe df4bcbb9191dc0a5facbed23dc30584d7d1c7532d4dee8e82edc810141f98971

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/665593/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/240736/

Comments