MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3a1001bfe5f5d08e9ca9b2bad47090707a272a533cda0299f6ecb514a46036d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ManusCrypt

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	e3a1001bfe5f5d08e9ca9b2bad47090707a272a533cda0299f6ecb514a46036d
SHA3-384 hash:	9c4694b4c0cd05799a77d17556a4cecad8b04019e8780058539d6d09cae2f2e1c983db617032733ef664facab2c7c866
SHA1 hash:	da227dbb27474fa5ddec855abd2b790534233b70
MD5 hash:	a519c8442164a8b1311fd1190cf0549c
humanhash:	pasta-lemon-angel-arkansas
File name:	a519c8442164a8b1311fd1190cf0549c.exe
Download:	download sample
Signature	ManusCrypt Create hunting rule
File size:	945'152 bytes
First seen:	2022-11-15 16:03:26 UTC
Last seen:	2022-11-15 18:08:31 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1818e86e01a8cce8b1f337b9457805bd (13 x ManusCrypt)
ssdeep	3072:RSYXGw6CPL8ps6U3vUAlBlbusYkt2OETC3p8zZbni72qlGqG111JvXy0RhPZKwCt:RSYXecod0CT+32hi72qlS11dXY7H
Threatray	561 similar samples on MalwareBazaar
TLSH	T170158AD22081F1A7D76596F5D155F4F609FC3C38EA1C22EB40633E60307EE6AD86A46B
TrID	40.3% (.EXE) Win64 Executable (generic) (10523/12/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4505/5/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	a28ecce8ccccc4f0 (25 x ManusCrypt, 1 x PseudoManuscrypt)
Reporter	abuse_ch
Tags:	exe ManusCrypt

Intelligence

File Origin

# of uploads :

# of downloads :

189

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

a519c8442164a8b1311fd1190cf0549c.exe

Verdict:

Malicious activity

Analysis date:

2022-11-15 16:04:53 UTC

Tags:

evasion stealer

Link:

https://app.any.run/tasks/209eb1a5-8274-4da3-92d7-8495f5e3e834

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/334400/

Detection(s):

SecuriteInfo.com.Trojan.Siggen13.63807.7149.15187.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Creating a file in the %temp% directory

Using the Windows Management Instrumentation requests

Launching a process

Sending a custom TCP request

Searching for synchronization primitives

Sending a UDP request

Possible injection to a system process

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm greyware manuscrypt

Link:

https://www.filescan.io/uploads/6373b874f75d59fef0b979e6/reports/bd06939e-00e1-4b02-8ec2-7a762995aa75/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c104f2ce-2681-4546-8925-286a17895fcf

Result

Threat name:

ManusCrypt

Detection:

malicious

Classification:

bank.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1113988

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to detect sleep reduction / modifications

Contains functionality to infect the boot sector

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Creates processes via WMI

Installs new ROOT certificates

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive service information (via WMI, MSSMBios_RawSMBiosTables, often done to detect sandboxes)

Queries temperature or sensor information (via WMI often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sets a auto configuration URL for Internet Explorer (IE settings are enforced automatically)

Sets debug register (to hijack the execution of another thread)

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected ManusCrypt

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e3a1001bfe5f5d08e9ca9b2bad47090707a272a533cda0299f6ecb514a46036d/

Threat name:

Win32.Backdoor.Manuscrypt

Status:

Malicious

First seen:

2022-11-14 15:02:49 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 25 (80.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4oqqag76l5oqr2oktmv22ryja4d2e4vfgpg2akm7n3fvcssganwq._file

Verdict:

malicious

ManusCrypt

189d5c23910cd58759aafae7139b258fc85d6fd588c04e56479d0c05a4dcdffd

ManusCrypt

33bc3ba6eea21f1e6448c200fdb94cb9e32d4a840bedaed9bd1bce8846951a44

ManusCrypt

394a7b1776167c159d8372ab8af7f4a90f0fe3674fe5061bb982032e5da8b141

ManusCrypt

3e38c14c9a27966b7768fa6a61a0bc86b79fdf8f554d232c26d0a13cd8dcdc36

ManusCrypt

bb4a6b871ebcb53e6de23a498790ec8aad7c392b465aa19ba5141bfa6a01e056

ManusCrypt

e0e00cdc8131a6cb50c336eb05dbc4d7f47a6a77aaad73b2ed869d2fc93abe40

ManusCrypt

f63dc116cf6f2bf6c2f33898d73ef0b974ed3fa9de67d840b50b35ee2d9390d9

ManusCrypt

fe053759e2973f96aa9c6c23e731eb6b4bc99da873324476e2d75477c38111d5

ManusCrypt

+ 551 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://tria.ge/reports/221115-thxv4aae2y/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies registry class

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in System32 directory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Loads dropped DLL

Unexpected DNS network traffic destination

Process spawned unexpected child process

Suspicious use of NtCreateUserProcessOtherParentProcess

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/878f717d-f972-4da6-9e14-eb6f5fc18512

Unpacked files

SH256 hash:

e3a1001bfe5f5d08e9ca9b2bad47090707a272a533cda0299f6ecb514a46036d

MD5 hash:

a519c8442164a8b1311fd1190cf0549c

SHA1 hash:

da227dbb27474fa5ddec855abd2b790534233b70

Link:

https://www.unpac.me/results/88d090b1-9883-4554-8843-694053cd9bb5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e3a1001bfe5f5d08e9ca9b2bad47090707a272a533cda0299f6ecb514a46036d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.