MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0dcc6358b3a2b04f45efab6bc62f51f7fcbea3fbffbe7f217450977a66b860e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f0dcc6358b3a2b04f45efab6bc62f51f7fcbea3fbffbe7f217450977a66b860e
SHA3-384 hash:	8083ad0b6534bb0add2bfa9f8265478670dd0e5e4ac73b9943e37a242ef79634ae1b6c80887477bb2bd92c02f4993ff8
SHA1 hash:	8fac4dc1bc6d7e1d5da4f79e0281d914b0ca2305
MD5 hash:	80bd8923515cc97c5c58f1c6faaaa9b8
humanhash:	failed-spring-december-jersey
File name:	SecuriteInfo.com.Trojan.Uztuby.4.22466.31170
Download:	download sample
File size:	1'805'839 bytes
First seen:	2023-07-03 17:37:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	aac51396886833dc961fcd7aab7711e4 (12 x NetSupport, 7 x DCRat, 4 x njrat)
ssdeep	24576:elMiZMVn1db5AnUZLP1UiZAJY7GhOIodEp8mgykBOeTP+b+sE0bf4v8LtMVJrVBP:5FPRZ0UaJoip9NN+s9bfHuDptuEcPO
Threatray	547 similar samples on MalwareBazaar
TLSH	T10B852302BAC58272C17319351A396B15AA7CBC302FB58DEF63C4296DEE311D0EA35767
TrID	91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) 0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	9494b494d4aeaeac (918 x DCRat, 486 x NirCmd, 172 x RedLineStealer)
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

290

Origin country :

FR

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

SecuriteInfo.com.Trojan.Uztuby.4.22466.31170

Verdict:

Suspicious activity

Analysis date:

2023-07-03 17:38:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5eee3166-845e-42ae-b8b3-99fe903a2fbf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/406111/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Uztuby.4.22466.31170.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Launching a process

Sending a custom TCP request

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/95410/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm fauppod greyware lolbin overlay packed packed replace setupapi shdocvw shell32

Link:

https://www.filescan.io/uploads/64a3077a26dab9d9c8508d2d/reports/ab1d8091-7f03-4082-8554-1bc7d69528e2/overview

Hybrid Analysis Trojan.Uztuby

Verdict:

Malicious

Labled as:

Trojan.Uztuby

Link:

https://www.hybrid-analysis.com/sample/f0dcc6358b3a2b04f45efab6bc62f51f7fcbea3fbffbe7f217450977a66b860e

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fe14dff6-a0d8-4c6f-883e-b10f8b4091e5

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1266154

Signature

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f0dcc6358b3a2b04f45efab6bc62f51f7fcbea3fbffbe7f217450977a66b860e/

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-03 17:38:05 UTC

File Type:

PE (Exe)

Extracted files:

18

AV detection:

18 of 24 (75.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6dommnmlhivqj5c67k3lyyxvd574x2r7x756p4qxiuexpjtlqyha._file

Threatray malicious

Verdict:

malicious

Similar samples:

0aed3882e07ef8574cdbb90140442e038e11eff10df31c84025daceeaf50877a

0af3aa9e62ae449301ef9b3d9965d45775c13b2fc7a662795d39585d5c0fa908

18ab5e7a8a16ee97cfaf8d710e023a7816f0e0c6e57c1d6ca2f9ca311db0dd12

33e686777d4e60947c1bc7d7743f006901dd209ae7fa9c6bd3d758dfc9b0aafc

3f64e635a811969032be1c3bd6d467b6edae118ea00996a66e56e9d798a4db03

7eb0ebc81444d77b62e03f1757763740d77009bd53a01ef19ce66e4dfe9bff77

8525d0bc1e38bb74d592de9be2615da94ec0b81e611b0e456b3a51c40ab5baa3

a040c35ef32cbe289d5bc2b8014adcb961ab3aed1e2873d1f2e335933e97927b

d102af126bcff04b5b089f3872b3add0fef3e755eea0182e8f28324b3c5dcc5f

+ 537 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230703-v7pfpaag8s/

Behaviour

Modifies registry class

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

746399c1ca14177f6218cc8b4921c670df6b324bab648383b97411f2f26ec6e9

MD5 hash:

490cf5e26cafce308a313d6bbef7f3de

SHA1 hash:

0afaa771d6fad50884e8b383a8e60174c7cb7929

Link:

https://www.unpac.me/results/b8445670-b1b6-4818-8343-75fc0c5fbe47/

SH256 hash:

f0dcc6358b3a2b04f45efab6bc62f51f7fcbea3fbffbe7f217450977a66b860e

MD5 hash:

80bd8923515cc97c5c58f1c6faaaa9b8

SHA1 hash:

8fac4dc1bc6d7e1d5da4f79e0281d914b0ca2305

Link:

https://www.unpac.me/results/b8445670-b1b6-4818-8343-75fc0c5fbe47/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe f0dcc6358b3a2b04f45efab6bc62f51f7fcbea3fbffbe7f217450977a66b860e

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2675870/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/406111/