MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eed25e577021fe8f43b3b78c7ce7bd0ec0087fd53258536f262533d0cae4177f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ousaban


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eed25e577021fe8f43b3b78c7ce7bd0ec0087fd53258536f262533d0cae4177f
SHA3-384 hash: 6bce49288cbef9f855712a6ef5a4c173bdf106d6b4ac6bc833aff09cc4d8905688a6fa3ea8920a7c3a305fa14b500b86
SHA1 hash: 506a6cc7838b4b1e08d74061651d9c11cceb485a
MD5 hash: e108ab26827b27789f09ecdcc3336784
humanhash: beryllium-twenty-don-oranges
File name:8511134429´.msi
Download: download sample
Signature Ousaban
Create hunting rule
File size:8'499'200 bytes
First seen:2022-11-24 09:41:31 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:UoPtK2mD6DYC+0ExJsqW6s0ZhW3wx/Q9exNf+8iSJQX+qDc2u6j:HVKPAG0UIWW6+5SJQX+qQ2uY
Threatray 154 similar samples on MalwareBazaar
TLSH T1E286334379CDCB33DDDF45F365AB831A46636D1092124537A20AAB0A7CF2251E2E72DB
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter JAMESWT_WT
Tags:msi ousaban

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/337998/
Detection(s):
SecuriteInfo.com.Trojan-Spy.Agent.22897.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.63825006.23269.1000.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.Pseudosigner-36
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
shell32.dll
Link:
https://www.filescan.io/uploads/637f3c6d24da1c12cfe19271/reports/28e29d58-4c80-4693-bbca-540072a61d80/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/eed25e577021fe8f43b3b78c7ce7bd0ec0087fd53258536f262533d0cae4177f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1120417
Signature
Antivirus detection for dropped file
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Drops PE files to the document folder of the user
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with function prologues
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Snort IDS alert for network traffic
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 753133 Sample: 8511134429#U00b4.msi Startdate: 24/11/2022 Architecture: WINDOWS Score: 100 52 Snort IDS alert for network traffic 2->52 54 Antivirus detection for dropped file 2->54 56 Multi AV Scanner detection for dropped file 2->56 58 3 other signatures 2->58 7 msiexec.exe 12 31 2->7         started        10 msiexec.exe 3 2->10         started        13 bPA08W0u.g7V.exe 2->13         started        process3 file4 34 C:\Windows\Installer\MSIF1F1.tmp, PE32 7->34 dropped 36 C:\Windows\Installer\MSIEF5F.tmp, PE32 7->36 dropped 38 C:\Users\user\Documents\x00x00x.exe, PE32 7->38 dropped 40 2 other files (1 malicious) 7->40 dropped 15 x00x00x.exe 2 19 7->15         started        20 msiexec.exe 7->20         started        68 Drops PE files to the document folder of the user 10->68 signatures5 process6 dnsIp7 44 webattach.mail.yandex.net 87.250.251.147, 443, 49696 YANDEXRU Russian Federation 15->44 28 C:\bPA08W0u.g7V\python23.dll, PE32 15->28 dropped 30 C:\bPA08W0u.g7V\picles.zip, PE32 15->30 dropped 32 C:\bPA08W0u.g7V\bPA08W0u.g7V.exe (copy), PE32 15->32 dropped 46 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 15->46 48 Overwrites code with function prologues 15->48 50 Tries to detect virtualization through RDTSC time measurements 15->50 22 bPA08W0u.g7V.exe 3 1 15->22         started        26 conhost.exe 15->26         started        file8 signatures9 process10 dnsIp11 42 38.54.95.222, 49697, 80 COGENT-174US United States 22->42 60 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 22->60 62 Creates autostart registry keys with suspicious names 22->62 64 Creates multiple autostart registry keys 22->64 66 Tries to detect virtualization through RDTSC time measurements 22->66 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eed25e577021fe8f43b3b78c7ce7bd0ec0087fd53258536f262533d0cae4177f/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-11-23 13:38:07 UTC
File Type:
Binary (Archive)
Extracted files:
58
AV detection:
12 of 41 (29.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=53jf4v3qeh7i6q5tw6ghzz55b3aaq76vgjmfg3zgeuz5bsxec57q._file
Verdict:
malicious
Similar samples:
411c449f978ff2425a9ee85a26157a0ba45a4895f6c1401a7c4d9a9c42c6a73b
Ousaban
58ae170573fd183ada1906291ca170724608a6a6217d84a6e5f0e400c3b1f481
Ousaban
6b5ac8a36a41a1220a049752119417478afd1ac433ac5b2da0e7c9560b38c52e
Ousaban
aa79b859945459fd6d1363c35e68c9d2674a78f1fdee02b8ddfab9a8fa011b48
Ousaban
c75b21d9f3189b648b2b83dae0fb48e49eb5458e8c3c5cfbdbcac460b43acc32
Ousaban
c86e30382131951485a3f60819910ce781f1a2fd55967c1565a74861e3026815
Ousaban
d72645347b3fa6134cc416b6b9d73eec9d4ef2af4dbf26c6b91da795144c394c
Ousaban
e134f20c16c2d118f95738897fc6c8f3be4ec46563ad7e1c243c3d7595a0ea68
Ousaban
ebc2784e2648e4ff72f48a6251ff28eee69003c8bd4ab604f5b43553a4140f4b
Ousaban
+ 144 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/221124-lpb8zahe6s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Adds Run key to start application
Enumerates connected drives
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eed25e577021fe8f43b3b78c7ce7bd0ec0087fd53258536f262533d0cae4177f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/337998/

Comments