MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecd6914b8c813bbcf312b0f78b703485cf8eff204b7e7df3cf97179028856aea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ecd6914b8c813bbcf312b0f78b703485cf8eff204b7e7df3cf97179028856aea
SHA3-384 hash: 65814af8333437fcfd152bde62fb3a40ca5fb47687a549a33a933625f0d5afdb6e98adf6a09da81fe2610750c67352e6
SHA1 hash: dfeec769fc41e2c8e3b778666693fa23917e173e
MD5 hash: c27180127362921dffe5091bb7053e4e
humanhash: jig-vermont-charlie-west
File name:SecuriteInfo.com.Trojan.GenericFCA.Script.33276.27996.26811
Download: download sample
File size:65'850'285 bytes
First seen:2024-08-04 14:21:45 UTC
Last seen:2024-08-04 15:15:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b34f154ec913d2d2c435cbd644e91687 (533 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep 1572864:trziNR3j8FhehY2uKHZXRBQ5s+9xfOKyOQCN6Dq7:IR3I0hBpXo9kCIu7
TLSH T1C5E73325E65D9862E1CE10FCE3C0CEC65D58BF10BE0300F9E2D63466AE66ECDE556923
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon e8b249cd4dc982e0 (7 x CoinMiner, 3 x DCRat, 3 x AsyncRAT)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
363
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.GenericFCA.Script.33276.27996.26811
Verdict:
Malicious activity
Analysis date:
2024-08-04 14:29:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4c6e73ba-ee67-4ee8-a032-89cf7b082eb9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66af8ea4b7a04efc7439d892
Tags:
Discovery Execution Generic Network Ransomware Stealth
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Searching for the window
Сreating synchronization primitives
Creating a process from a recently created file
Creating a window
Creating a file in the %AppData% subdirectories
DNS request
Searching for synchronization primitives
Connection attempt
Unauthorized injection to a recently created process
Sending a custom TCP request
Creating a file
Moving a file to the %AppData% subdirectory
Running batch commands
Creating a process with a hidden window
Launching a process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
installer lolbin microsoft_visual_cc overlay packed shell32
Link:
https://www.filescan.io/uploads/66af8e9a84afcda96264de19/reports/9cb00d84-e2d4-429b-af95-3cd72cffe61f/overview
Verdict:
Suspicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/ecd6914b8c813bbcf312b0f78b703485cf8eff204b7e7df3cf97179028856aea
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1487579
Signature
Connects to a pastebin service (likely for C&C)
Drops executable to a common third party application directory
Drops large PE files
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
58%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/ecd6914b8c813bbcf312b0f78b703485cf8eff204b7e7df3cf97179028856aea
Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-02-19 20:16:12 UTC
File Type:
PE (Exe)
Extracted files:
2446
AV detection:
6 of 24 (25.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5tljcs4mqe53z4yswd3yw4buqxhy57zajn7h346ps4lzakefnlva._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  9/10
Tags:
credential_access discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/240804-rpm85a1gmc/
Behaviour
Detects videocard installed
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Enumerates processes with tasklist
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Credentials from Password Stores: Credentials from Web Browsers
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fc7de328-65b0-400e-aacd-04e3d1f5f93b
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe ecd6914b8c813bbcf312b0f78b703485cf8eff204b7e7df3cf97179028856aea

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3088220/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::SetFileSecurityW
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileExW
KERNEL32.dll::MoveFileW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments