MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f14c5bad5219b1ed5166eb02f5ff08a890a181cef2af565f3fe7bcea9c870e22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f14c5bad5219b1ed5166eb02f5ff08a890a181cef2af565f3fe7bcea9c870e22
SHA3-384 hash:	f2e2584f1861fa9f11e64853027e5767f6d3ddd65c7cc05de6c3c8a14beb9843197edaeddcd3da522634db1369d1df35
SHA1 hash:	7cf53577520861a1833ae99489c307f98da01b4b
MD5 hash:	931d0969654af3f77fc1dab9e2bd66b1
humanhash:	helium-lactose-colorado-river
File name:	f14c5bad5219b1ed5166eb02f5ff08a890a181cef2af565f3fe7bcea9c870e22
Download:	download sample
Signature	Lazarus Alert Create hunting rule
File size:	161'792 bytes
First seen:	2022-11-24 11:14:55 UTC
Last seen:	2022-11-24 12:39:52 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	9a245851a75a4fb6e87a52d12330118f (1 x Lazarus)
ssdeep	3072:PXbMMsw6csaVqBuH9HJt+BvgDzuLlTlB:YFwnlwBK9f+04lTH
TLSH	T1E6F31A4BF252E8F8E923523584715C076B72BC3A59606B5F128CF6663E332525C2FE72
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	74e4d4d4ecf4d4d4 (23 x GuLoader, 22 x AgentTesla, 21 x LummaStealer)
Reporter	JAMESWT_WT
Tags:	exe Lazarus

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

253

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

Malware-1.zip

Verdict:

No threats detected

Analysis date:

2022-11-23 13:56:11 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/cc5498e4-9d3b-4d10-b677-a09761195e5c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/338027/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Loader.1196.15692.18441.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  2/10

Confidence:

100%

Tags:

greyware shell32.dll

Link:

https://www.filescan.io/uploads/637f523a090ea3f049348126/reports/d7d1aa75-8ec6-46ff-98b5-171721b47bc2/overview

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/506ea6d6-074e-4361-8266-c92cd7a378a5

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1120464

Signature

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f14c5bad5219b1ed5166eb02f5ff08a890a181cef2af565f3fe7bcea9c870e22/

ReversingLabs TitaniumCloud Win64.Trojan.NukeSped

Threat name:

Win64.Trojan.NukeSped

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-11-23 06:22:39 UTC

File Type:

PE+ (Exe)

Extracted files:

16

AV detection:

16 of 41 (39.02%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6fgfxlksdgy62ulg5mbpl7yivcikdaoo6kxvmxz7466ovhehbyra._file

Threatray malicious

Verdict:

malicious

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/221124-nckexsdd7x/

Threat.Zone Informative

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/f265d1e8-f2de-4799-bd5b-c5ad974e16c3

UnpacMe

Unpacked files

SH256 hash:

f14c5bad5219b1ed5166eb02f5ff08a890a181cef2af565f3fe7bcea9c870e22

MD5 hash:

931d0969654af3f77fc1dab9e2bd66b1

SHA1 hash:

7cf53577520861a1833ae99489c307f98da01b4b

Link:

https://www.unpac.me/results/06bfcd5a-5723-45cd-ae54-7c45f4db8ffc/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f14c5bad5219b1ed5166eb02f5ff08a890a181cef2af565f3fe7bcea9c870e22

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/338027/