MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1364b7144e6240f9dfede83f545c99e8fe47acefda67f9e3edf7e560fc1989c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1364b7144e6240f9dfede83f545c99e8fe47acefda67f9e3edf7e560fc1989c
SHA3-384 hash: 99b5604415c62b515023a799cfa61d4b8b9dedf58ca46e81d5111fb7152377a86cc429ef8c5c0a62d0c1289fe44fd57f
SHA1 hash: 7d1d4cf7dd4c44002adc8c294b700f67685c6384
MD5 hash: 5614579c61299fbc4ff5a91e10312302
humanhash: indigo-tango-ink-alaska
File name:file
Download: download sample
File size:269'824 bytes
First seen:2023-01-09 11:55:17 UTC
Last seen:2023-01-09 17:11:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 50d8a4762b09f148cecbce7073cf1ef4
ssdeep 6144:HgAusUtcchXCk6oir1jLzA4tmXgOU9o5S:HgAujtcM6TrFvmS
TLSH T14E447CCCB4DA84B9C4324D3ECDF679DC8768A7600A345B1FA77D0B391AB014D66A26D3
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:exe


Avatar
andretavare5
Sample downloaded from https://www.conectiva.pe/doc/file.exe

Intelligence

File Origin
# of uploads :
8
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
azorult
Create hunting rule
ID:
1
File name:
https://keygenlion.com/serial/fl-studio-20.html
Verdict:
Malicious activity
Analysis date:
2022-11-30 19:34:44 UTC
Tags:
evasion trojan rat azorult fareit pony stealer
Link:
https://app.any.run/tasks/280a460b-fd08-4f65-98b1-9b9556b0d847

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/351084/
Detection(s):
SecuriteInfo.com.Variant.Doina.46830.17580.21982.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Launching a process
Downloading the file
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
greyware packed rat shell32.dll
Link:
https://www.filescan.io/uploads/63bc00d240e878e304240ba5/reports/6cfb51bd-1158-4fdb-9ac4-a79f2a054248/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/169d3fb6-c37a-4144-bd00-9b7d92ee62a6
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1147937
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Sigma detected: Powershell Download and Execute IEX
Uses ping.exe to check the status of other devices and networks
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 780669 Sample: file.exe Startdate: 09/01/2023 Architecture: WINDOWS Score: 92 37 Multi AV Scanner detection for domain / URL 2->37 39 Antivirus detection for URL or domain 2->39 41 Antivirus / Scanner detection for submitted sample 2->41 43 3 other signatures 2->43 7 file.exe 13 2->7         started        process3 dnsIp4 33 conectiva.pe 144.217.158.133, 443, 49699, 49700 OVHFR Canada 7->33 35 www.conectiva.pe 7->35 45 Self deletion via cmd or bat file 7->45 11 cmd.exe 1 7->11         started        14 cmd.exe 1 7->14         started        signatures5 process6 signatures7 47 Uses ping.exe to check the status of other devices and networks 11->47 16 PING.EXE 1 11->16         started        19 conhost.exe 11->19         started        21 powershell.exe 14 14 14->21         started        23 conhost.exe 14->23         started        process8 dnsIp9 25 127.0.0.1 unknown unknown 16->25 27 www.conectiva.pe 21->27 29 conectiva.pe 21->29 31 62.233.57.95, 49707, 80 DivisionWRSBE unknown 21->31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e1364b7144e6240f9dfede83f545c99e8fe47acefda67f9e3edf7e560fc1989c/
Threat name:
Win32.Downloader.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2022-11-30 04:01:50 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
31 of 41 (75.61%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4e3ew4ke4ysa7hp632b7krojt2h6i6wo7wth7hr6357fmd6btcoa._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/230109-n31jtshe6s/
Behaviour
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Deletes itself
Blocklisted process makes network request
Malware Config
Dropper Extraction:
https://www.conectiva.pe/doc/config_20.ps1
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1efeacc3-33e9-4bf2-a0d5-2030c18c4851
Unpacked files
SH256 hash:
e1364b7144e6240f9dfede83f545c99e8fe47acefda67f9e3edf7e560fc1989c
MD5 hash:
5614579c61299fbc4ff5a91e10312302
SHA1 hash:
7d1d4cf7dd4c44002adc8c294b700f67685c6384
Link:
https://www.unpac.me/results/4ebf69e8-e7f5-476a-bcc2-531f4d0e706a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e1364b7144e6240f9dfede83f545c99e8fe47acefda67f9e3edf7e560fc1989c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/351084/
  
URLhaus
https://urlhaus.abuse.ch/url/2502117/

Comments