MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eff25e4f37052bfd3d8e82cb7d1f6f16119cfbc6177f29d0697ae0d90cb87837. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eff25e4f37052bfd3d8e82cb7d1f6f16119cfbc6177f29d0697ae0d90cb87837
SHA3-384 hash: 660dc8901804e88cf40018af7c550cea9348b95071727fe265bb631df8a5a6bedca4255c9568dcf60e6508fa6ca391fd
SHA1 hash: acebeb2355a1220864cfed23e7679c7663ab73b8
MD5 hash: dddfe8a7304ce8d9f23c97b52ebd2a77
humanhash: uranus-triple-carolina-speaker
File name:SecuriteInfo.com.Trojan.MulDrop26.56856.10093.16154
Download: download sample
File size:2'654'928 bytes
First seen:2024-04-28 09:31:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0ae9e38912ff6bd742a1b9e5c003576a (10 x DCRat, 7 x RedLineStealer, 4 x AsyncRAT)
ssdeep 49152:kILiIqJ3BGATBnXuWcYugP+dIrU4GOHqJAEi1EO6Qn:kFIqZB2DTrIhXOAB1EFS
Threatray 172 similar samples on MalwareBazaar
TLSH T167C52302B5C14DB2D2A62A734A755F31A9797C301F72CDCF8798992DEB721C0DA3076A
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter SecuriteInfoCom
Tags:exe signed

Code Signing Certificate

Organisation:Bitsum LLC
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2023-02-07T00:00:00Z
Valid to:2025-03-08T23:59:59Z
Serial number: 0b494d7df02097107b9065025133fe92
Intelligence: 27 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: b309179e6516e33d374264683b0751db5f23b09e625ff0b6a4163df28051d08c
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
286
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
eff25e4f37052bfd3d8e82cb7d1f6f16119cfbc6177f29d0697ae0d90cb87837.exe
Verdict:
Malicious activity
Analysis date:
2024-04-28 09:55:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/abeec3fa-85f0-4f5e-ac26-bc9da3bd5670

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
Enabling autorun by creating a file
Verdict:
Malicious
Labled as:
Malware.Dropper
Link:
https://www.hybrid-analysis.com/sample/eff25e4f37052bfd3d8e82cb7d1f6f16119cfbc6177f29d0697ae0d90cb87837
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/33f48988-ff14-47df-b67a-75fd0518fa02
Result
Threat name:
n/a
Detection:
clean
Classification:
evad
Score:
9 / 100
Link:
https://www.joesandbox.com/analysis/1432853
Behaviour
Behavior Graph:
n/a
Score:
51%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/eff25e4f37052bfd3d8e82cb7d1f6f16119cfbc6177f29d0697ae0d90cb87837
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eff25e4f37052bfd3d8e82cb7d1f6f16119cfbc6177f29d0697ae0d90cb87837/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=57zf4tzxauv72pmoqlfx2h3pcyizz66gc57studjplqnsdfypa3q._file
Verdict:
unknown
Similar samples:
68ac5530196b3a92fe6574954e62dac0b98cbac6e746f9c170f00b88fa2c5421
7286f654cd20d04b97fe0eac2f6ab36e6503c33b9747512043684b210ca4c87f
d53bf41616a88bda36fcc57594529271ac4abf4a568cac98af802592145d0396
eff25e4f37052bfd3d8e82cb7d1f6f16119cfbc6177f29d0697ae0d90cb87837
f9ba39cc36ba8dd4cfb3f461e834660d55f12f76c8696dd04244db1e9db87051
ff485295aa61623a812644de7e6fead2c1b36c33fde939e042a783dffdefd7e0
+ 162 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240428-lhmq5ach7x/
Behaviour
Checks processor information in registry
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Unpacked files
SH256 hash:
f29cd6c8f26c61fa1b7cb48ad2e146591da1f2ec3478f1001587bad73097bb59
MD5 hash:
2a9838ed7121b14e9db6b99fbc7ebc47
SHA1 hash:
01d00dbe55452ab4e73485f915bb5da082bf98ba
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
f1a502d562375ef9dbce64d9cbc17c7054ab21cf2c0dd519dd712d5bf2167e88
MD5 hash:
ec31c513ae0a65f330ac1328ecf38fae
SHA1 hash:
169905f36fe452658052515a7819e75abfd07e9a
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
eb8edfd5abd6a79ed649287fd224b329af436cb98bba3a7dd40020cffeea4be9
MD5 hash:
7e26e352563cf0ac6243f5a8f27bba8d
SHA1 hash:
53e7eaed08d4cc4409c79b4b6aa183dd6aa510a0
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
e747095e7cdf50fe89c63dae392d42bdb4de71a0e9b0df481ea752f3d041f952
MD5 hash:
484c7b154757e4e81c3da5e393becd2a
SHA1 hash:
dc33e89ab6c0c1c58398d02b40722e2c4f9d9853
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
da8e1ee3660b9ad4ac01a285b2c47017889bca737d583ed58a1d818ab0cd3e77
MD5 hash:
4f977f4d518b2ca0a71a72136032f756
SHA1 hash:
f81b40cdb182123b2b02d0c80331e18a8bb3eef9
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
d6047455fa5d093b2d8346197e92837257bed689d1186bf91ceac8d85892ceb6
MD5 hash:
4d2a890b9d8ef771c957f4b9c6e7ffca
SHA1 hash:
db37586b85dd79c35b4fe807cee2341cfa425093
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
c5b6dd95fbbf57696c0b8946769f0b06ce1e0075a23b9e13f73aef71fb461db0
MD5 hash:
2fb603b0a31403fe39a9bac61785689b
SHA1 hash:
a5ed068577603ac59918ec75af3640f83d68e929
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
c09c3b74ad545aecebb243770aa4890c3759d3024dfa9db07691219247eb3a59
MD5 hash:
b5683ed5b7373e20f0a5f5eed003f47b
SHA1 hash:
140b6147550ae5d5962c83b5592c4e3ecbea9573
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
b4fc6d2987928c88e3016a4340a0862a4d6c178431279f6954f7185492aa8ccd
MD5 hash:
d7e39dea620f53b23d2f3e5a97516e66
SHA1 hash:
f4c9c5ce49d99bc3dd253f428d6c1cd263e10895
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
8bd7e64554292caf8b1ff37c416d3b8cb59cd5b25d122ecab202d0b2a2bf00cc
MD5 hash:
c426a815476e5a7e630f9e3f7c9be59b
SHA1 hash:
003cc8251611b1eb8a153951c3ffbf7cf94c715d
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
86fe636550a439edf9f55c14d2c766732087e2cc676e7946917cc149c7fc3f52
MD5 hash:
6371513a1089b3086d3001911a7f53d7
SHA1 hash:
bdc771fc72933ea37e61abec30ed57c332287bae
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
78da807da9e87a82ec2a54830b207ab32079b1e876cd06dd82c5cf30166297c3
MD5 hash:
6920f86cc0aeb9fdaf8e6310ac894d66
SHA1 hash:
78d7987aab0e62c24c017af1459040ace5516104
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
6af983fc1f88682e001033099b50fbfa2631b43be909b70b246ba2e95e14146c
MD5 hash:
97cd5a4c2e3bbc59eced113256806260
SHA1 hash:
37941456778b3ab4838e9784692690d1edf70dc4
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
3ffa093b952719eaee17307a9f02144a5763e3323dc2c386e16790959a1988c4
MD5 hash:
eadc939f10fef9f9701c972c90b310f9
SHA1 hash:
9fad02c67f887b2a694d99eb979eeb9ce17ab73d
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
34bc8d0f3d2410c2220e5e9bdca7ae0a47ecf60d8ddae1b815d41fc620a80a12
MD5 hash:
95881f07fb0a37a9aa3683836544383c
SHA1 hash:
3d0f13d9372afb6d8dc9206986a3d9cad3525e08
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
0cd0e862e7e13f00bb8f9d0dcc6aa0e700c85ac9a1e5a179715afed70b348831
MD5 hash:
01ef5a0c8de68bd39795a9a1d45d3abf
SHA1 hash:
8e02b1bc931107e6058c5b71b6d24ceb90ffb46e
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
0becf5438d00b2bf0c0b4f6583d4af772d6eb3a5b7532a7a16742de2f3f697c3
MD5 hash:
e8756ea8f3f15d30efd0d86ea194f82d
SHA1 hash:
3bdf93355befa6dffcde23b8f553d1754d844539
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
SH256 hash:
eff25e4f37052bfd3d8e82cb7d1f6f16119cfbc6177f29d0697ae0d90cb87837
MD5 hash:
dddfe8a7304ce8d9f23c97b52ebd2a77
SHA1 hash:
acebeb2355a1220864cfed23e7679c7663ab73b8
Link:
https://www.unpac.me/results/2ac8e8dd-8fc8-4f16-a418-44afcb079514/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eff25e4f37052bfd3d8e82cb7d1f6f16119cfbc6177f29d0697ae0d90cb87837

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdiplusShutdown
gdiplus.dll::GdipAlloc
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::AttachConsole
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::FreeConsole
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW

Comments