MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1530e55a185d7733d470ba0e450464c7e9a95425025a51b79a3795b9f44ada9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1530e55a185d7733d470ba0e450464c7e9a95425025a51b79a3795b9f44ada9
SHA3-384 hash: d72942393b56bb1edc7494f6a817f02271e61d294196312b9a552cd4ba1996c28beec2929995750e430731f1c4157934
SHA1 hash: 5b6ee83208bb1525a53c52094273f9fe6a66a14f
MD5 hash: 147dc8283c78473a5df1d2e078199f5c
humanhash: jersey-kansas-wisconsin-coffee
File name:147dc8283c78473a5df1d2e078199f5c
Download: download sample
File size:4'350'976 bytes
First seen:2021-07-18 10:03:00 UTC
Last seen:2021-07-18 10:35:06 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:jY6lUA9mLpUU2i0pU8DrEMdvdit2a3bYSC2AKJ:vIf2V6CrEMd1iUarYSC2AS
Threatray 7 similar samples on MalwareBazaar
TLSH T13B16011279CAC636FA7E45307569CB3A54F97EE00BB188DB63D49A2E1E700C1427AF17
Reporter zbetcheckin
Tags:msi

Intelligence

File Origin
# of uploads :
2
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172398/
Detection(s):
PUA.Win.Packer.Pseudosigner-36
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Exe-6
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/e1530e55a185d7733d470ba0e450464c7e9a95425025a51b79a3795b9f44ada9
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/817911
Signature
Connects to a pastebin service (likely for C&C)
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e1530e55a185d7733d470ba0e450464c7e9a95425025a51b79a3795b9f44ada9/
Threat name:
Win32.Trojan.Banbra
Create hunting rule
Status:
Malicious
First seen:
2021-07-13 00:27:00 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
02cead8bc66fb8b15702508eb0681a0c2f26846962fd95cf621f84d481454927
11c4168836b333b67b3c16e26ccaac22c524a4bfce6c106837473d7079c3c18e
21b86d066be79ef02c1e00c3be9bf22c4087d4122569543d2c8854ccb8a9b129
77d83370f3109b9a0c199c60870edd92184c170abfc2f1817cd625245fcfae10
8a825ecb2e8b53dc91553e58e86500d8d3e137d8894b9a61d45966087f686847
bf4c790ed75074b826071aa764c692ca84b78159759909fdfff5cf4ac4672c20
f016bb4e883c001c82a4cf91745844f14b76fd015a2747c491badae79c2b0911
Result
Malware family:
n/a
Score:
  9/10
Tags:
persistence upx
Link:
https://tria.ge/reports/210718-vkn8mwxjv6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Adds Run key to start application
Enumerates connected drives
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Executes dropped EXE
UPX packed file
ACProtect 1.3x - 1.4x DLL software
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.25
Link:
https://yomi.yoroi.company/submissions/e1530e55a185d7733d470ba0e450464c7e9a95425025a51b79a3795b9f44ada9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi e1530e55a185d7733d470ba0e450464c7e9a95425025a51b79a3795b9f44ada9

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1463481/
Cape
Cape
https://www.capesandbox.com/analysis/172398/

Comments


Avatar
zbet commented on 2021-07-18 10:03:02 UTC

url : hxxps://sndrunyt.s3.us-west-000.backblazeb2.com/STDR_EMP_MDLSGR.msi