MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0bd41a5caf387cc9f50940678ae8ab257d54c15573f04d7b01cd9db19022337. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f0bd41a5caf387cc9f50940678ae8ab257d54c15573f04d7b01cd9db19022337
SHA3-384 hash:	ba3e66a66a7ff27c4d1981a0c9cc2db8c12915a0975d7e7ec41b323a6f1fc24f06450b2b8b318fae1f792a986aba6ee8
SHA1 hash:	bac72b20bdd5b1f74c004402e3ba5f308970b9c3
MD5 hash:	c4d78367f6c31af8334a89927f611dbc
humanhash:	tennessee-princess-hydrogen-october
File name:	file
Download:	download sample
File size:	2'782'151 bytes
First seen:	2023-12-09 21:11:36 UTC
Last seen:	2023-12-09 22:40:12 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e24e2b765a0ca8ebb142df10bd69ab5c
ssdeep	49152:cYeTqRWzQssYILMd9OrKd49+vmYFPrlTah4NJclSDN6Lch+CxS6su/U66QUm/7Uo:cY0a8e6UrKd4LYFgh4NJ6A4LSk9QUgp
Threatray	26 similar samples on MalwareBazaar
TLSH	T163D5337A1361A54BC8BA9D315C6B3F664335C86121F205874F3ADF9C46F00EEE9911FA
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	848c5454baf46e68 (1 x PrivateLoader)
Reporter	andretavare5
Tags:	exe

andretavare5

Sample downloaded from https://IOIOUOIUOUOUIYJGROUP.SBS/setup294.exe

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

309

Origin country :

US

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/464068/

ClamAV Detected

Detection(s):

Win.Packed.Zenpak-10014145-0

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Running batch commands

Launching a process

Dragonfly

Gathering data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

fauppod installer lolbin overlay packed packed setupapi sfx shell32

Link:

https://www.filescan.io/uploads/6574d8223636548f37465be4/reports/6d85725c-063e-4f16-90dd-b70829759834/overview

Hybrid Analysis Trojan.Zenpak

Verdict:

Malicious

Labled as:

Trojan.Zenpak

Link:

https://www.hybrid-analysis.com/sample/f0bd41a5caf387cc9f50940678ae8ab257d54c15573f04d7b01cd9db19022337

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Raspberry Robin

Malware family:

Raspberry Robin

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bcbec0b5-a88b-4e93-add6-d4545fe2d7aa

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1357026

Signature

Antivirus detection for dropped file

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

PE file contains section with special chars

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/f0bd41a5caf387cc9f50940678ae8ab257d54c15573f04d7b01cd9db19022337

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f0bd41a5caf387cc9f50940678ae8ab257d54c15573f04d7b01cd9db19022337/

ReversingLabs TitaniumCloud Win32.Trojan.Privateloader

Threat name:

Win32.Trojan.Privateloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-09 21:12:05 UTC

File Type:

PE (Exe)

Extracted files:

8

AV detection:

19 of 23 (82.61%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6c6udjok6od4zh2qsqdhrlukwjl5ktavk47qjv5qdtm5wgicem3q._file

Threatray malicious

Verdict:

malicious

Similar samples:

5ee5c46d61a945ad630a4d86a34959cb99242006a87b6d03f6c3f0ac96afa279

69ded352d815114251f0986f1f9d16702f1b33372c23fe8de2cd18ddab231e13

79522f2262f25eb641e67055f7fa04ad13454916205d5184297e3d76c20aa6ca

a8f9f54a7cf79d63e3403e787476cd40a5358061cb97eae692dd4c717494a222

ed7576fc818a48282828e4ee25c4ae7d09d7c1c22521954498dbc2942576151a

f0bd41a5caf387cc9f50940678ae8ab257d54c15573f04d7b01cd9db19022337

+ 16 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/231209-z1573scbb9/

Behaviour

Modifies registry class

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

040b1fe6ea7527d7a5fe82d20a7d478b8a7825aa9689b555198603d4bc37d890

MD5 hash:

106c50d8f4ef16a8908d7d36a4469c6c

SHA1 hash:

5e46f972b2b696f29074fdb1524d95645a62d4de

Link:

https://www.unpac.me/results/4d1c8e66-38f5-448b-9241-f8b011fbfcae/

SH256 hash:

f0bd41a5caf387cc9f50940678ae8ab257d54c15573f04d7b01cd9db19022337

MD5 hash:

c4d78367f6c31af8334a89927f611dbc

SHA1 hash:

bac72b20bdd5b1f74c004402e3ba5f308970b9c3

Link:

https://www.unpac.me/results/4d1c8e66-38f5-448b-9241-f8b011fbfcae/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f0bd41a5caf387cc9f50940678ae8ab257d54c15573f04d7b01cd9db19022337

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

Dropped by

PrivateLoader

  

Delivery method

Distributed via drive-by

Cape

https://www.capesandbox.com/analysis/464068/