MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9b29df96b107114bac6ebb4f5ead3398f815598493e70cf70250c4fb48dc097. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9b29df96b107114bac6ebb4f5ead3398f815598493e70cf70250c4fb48dc097
SHA3-384 hash: eca53a8c01a55cee26d3bfd3b7c4d531a5b83ab2d382d24c13aac1df93d69f33cd4e631f8bf99f3e2739ae259fb81322
SHA1 hash: 4cddecc4a2db373f4e3c87c4d7f5539a767b9bf9
MD5 hash: 8a3345a44845ae0780aa043b2a4dd70c
humanhash: carolina-summer-asparagus-leopard
File name:2.exe
Download: download sample
File size:1'309'184 bytes
First seen:2022-12-10 12:42:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9cbefe68f395e67356e2a5d8d1b285c0 (58 x LummaStealer, 49 x AuroraStealer, 36 x Vidar)
ssdeep 24576:qHFR4ZzZv+0Syrb/TUvO90d7HjmAFd4A64nsfJg47ckISFgfSey7a1s:qHFR4Z9v+0Syrb/TUvO90d7HjmAFd4A2
Threatray 75 similar samples on MalwareBazaar
TLSH T1C8555A0BBC9081BAD4BA9231896592E17B31BC890B3123D73B01B7F92F767D45E79358
gimphash 90d440aaf6545f21033c0d29e009397f6602e32343306dde00d65057a78c3e6f
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter Anonymous
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
JP JP
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/344990/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
golang greyware
Link:
https://www.filescan.io/uploads/63947ed79a505ad9423eb6c3/reports/dd0ca85d-6680-41b2-85f7-307ea16695b1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
ModernLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/26e4ce6d-760e-4075-aff5-383652fd070c
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1131943
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 764667 Sample: 2.exe Startdate: 10/12/2022 Architecture: WINDOWS Score: 56 11 Multi AV Scanner detection for submitted file 2->11 13 Machine Learning detection for sample 2->13 6 2.exe 1 2->6         started        process3 signatures4 15 Potentially malicious time measurement code found 6->15 9 conhost.exe 6->9         started        process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e9b29df96b107114bac6ebb4f5ead3398f815598493e70cf70250c4fb48dc097/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-11-30 19:54:04 UTC
File Type:
PE+ (Exe)
AV detection:
13 of 26 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5gzj36llcbyrjowg5o2pl2wthghycvmyje7hbt3qeuge7nenyclq._file
Verdict:
malicious
Similar samples:
1fa7c0030e8a0f71b80e37ba97408d1b3131d0c2ba4f4f50ece88d96fe175ac6
5334c9a9792df13c2ff710ec7d1989c19b04bbd623c55a221c432dd94628dade
6d0429bb3533ea8cd3b10d207ec5505ac0d38692f7f4cd1375db7cd1aba0be6e
79d3cda3ddf9f7b2d8f94a733d06b8d21bb3c5dbcb77e1fe8a28f7ff87364447
91aaaa1b0672caace5865b8c42da45a0efafe4dc373d9e1999e9411e31be17d1
94e55f1981d309c200304267e75948dde7cae6a852e2539650016c28d7575900
a69036cd1bbf702c38423dda4ad3eef50af554b0a3dbcfdcd273dd5a3a27d18d
af9b0aceb849661464687ad60a63732dc1391838e463e6eb29fbf52e2feb3a58
d0f9729789ebf3dccc68f2d2823ae00622145c646f5ccc1d8899ac1faffc249f
e90dc87153cee99a26b2b6beb37d7ea8e769b7d90c7e2dd8e3106c3c87571561
+ 65 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/221210-pxxfnafe72/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2cfdc9c9-a2bb-4d2d-a850-9152895f7d92
Unpacked files
SH256 hash:
e9b29df96b107114bac6ebb4f5ead3398f815598493e70cf70250c4fb48dc097
MD5 hash:
8a3345a44845ae0780aa043b2a4dd70c
SHA1 hash:
4cddecc4a2db373f4e3c87c4d7f5539a767b9bf9
Link:
https://www.unpac.me/results/68b3444b-401b-498f-8eb6-320c8e6662d4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.46
Link:
https://yomi.yoroi.company/submissions/e9b29df96b107114bac6ebb4f5ead3398f815598493e70cf70250c4fb48dc097

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_bin
Create hunting rule
Author:Jonathan Cole
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_build_id_strings
Create hunting rule
Author:Jonathan Cole
Description:Matches on string Golang build ID
Rule name:go_binary
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/344990/

Comments