MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f19a795a01ec22eb27174da923ca0721e22baa7f0982059b0e644c76b6154a3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Hive


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f19a795a01ec22eb27174da923ca0721e22baa7f0982059b0e644c76b6154a3f
SHA3-384 hash: 5de21ad575e00938f005ba3281fcfe1f249f59b1539137a4d5e294b62544ecdcb4b88e612250c1b4f2d2f1901b1181f9
SHA1 hash: 2040f567dbde0513a67a619a25422314288e83ac
MD5 hash: d178077acbb10e9fc1eae2e8dbc008ef
humanhash: juliet-bulldog-arkansas-massachusetts
File name:d178077acbb10e9fc1eae2e8dbc008ef
Download: download sample
Signature Hive
Create hunting rule
File size:5'681'152 bytes
First seen:2022-07-04 10:18:33 UTC
Last seen:2022-07-04 11:16:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ef5ee1a30d4a83fd2256bd92297da50a (7 x Hive, 1 x RedLineStealer, 1 x 000Stealer)
ssdeep 49152:6tSHkCyvh0uhRLTxd+K7EIrbgGCpLXadU/8IrOZHZVRcfM62d7EpTW/61jn+E0tE:65veub/x6ebgGCpLXSRZ06sx97Du
TLSH T1C8464B90F9DB84F2EA03557004A762AF23306E0A4B39DEC7D6407F6AFCB66E10977525
gimphash b85fba3ca3375a0eca27df48a172127e99cd708fac23df86d74c29fb5cb344ca
TrID 37.2% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
27.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
14.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
5.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter zbetcheckin
Tags:32 exe Hive

Intelligence

File Origin
# of uploads :
2
# of downloads :
344
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.17736.15404.4255.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Reading critical registry keys
Using the Windows Management Instrumentation requests
Stealing user critical data
Sending a TCP request to an infection source
Forced shutdown of a browser
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/23695/overview
Behaviour
MalwareBazaar
CPUID_Instruction
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/62c2be9a11764e36f81293fb/reports/09a99b21-605a-429d-ab3e-ff05c88eee4a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/65cd3160-c3f7-4b8f-adf3-589d9f1c64f6
Result
Threat name:
000Stealer, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1024106
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Machine Learning detection for dropped file
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Xmrig
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected 000Stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 656606 Sample: l4M225Ggtn Startdate: 04/07/2022 Architecture: WINDOWS Score: 100 64 Snort IDS alert for network traffic 2->64 66 Sigma detected: Xmrig 2->66 68 Multi AV Scanner detection for domain / URL 2->68 70 7 other signatures 2->70 12 l4M225Ggtn.exe 2 2->12         started        17 UGBOMITO.exe 2->17         started        19 UGBOMITO.exe 1 2->19         started        process3 dnsIp4 62 185.112.83.111, 49724, 49725, 49726 SUPERSERVERSDATACENTERRU Russian Federation 12->62 58 C:\Users\user\AppData\Local\Temp\rat.exe, PE32 12->58 dropped 100 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 12->100 102 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 12->102 104 Tries to harvest and steal ftp login credentials 12->104 106 3 other signatures 12->106 21 rundll32.exe 1 12->21         started        file5 signatures6 process7 process8 23 rat.exe 3 21->23         started        file9 54 C:\Users\user\...\DNMMQNNNPxACWOZPXDdd.exe, PE32 23->54 dropped 80 Antivirus detection for dropped file 23->80 82 Multi AV Scanner detection for dropped file 23->82 84 Detected unpacking (changes PE section rights) 23->84 86 2 other signatures 23->86 27 DNMMQNNNPxACWOZPXDdd.exe 5 23->27         started        signatures10 process11 file12 56 C:\ProgramData\vhjvjhjbgjg\UGBOMITO.exe, PE32 27->56 dropped 92 Antivirus detection for dropped file 27->92 94 Multi AV Scanner detection for dropped file 27->94 96 Detected unpacking (changes PE section rights) 27->96 98 2 other signatures 27->98 31 cmd.exe 1 27->31         started        signatures13 process14 signatures15 108 Uses schtasks.exe or at.exe to add and modify task schedules 31->108 34 UGBOMITO.exe 15 5 31->34         started        39 timeout.exe 1 31->39         started        41 conhost.exe 31->41         started        process16 dnsIp17 60 microsoftvisualstudio.wtf 185.105.110.4, 49735, 49736, 80 VDSINA-ASRU Russian Federation 34->60 52 C:\ProgramData\vhjvjhjbgjg\ton.exe, PE32+ 34->52 dropped 72 Antivirus detection for dropped file 34->72 74 Multi AV Scanner detection for dropped file 34->74 76 Detected unpacking (changes PE section rights) 34->76 78 3 other signatures 34->78 43 ton.exe 34->43         started        46 cmd.exe 1 34->46         started        file18 signatures19 process20 signatures21 88 Multi AV Scanner detection for dropped file 43->88 90 Machine Learning detection for dropped file 43->90 48 conhost.exe 46->48         started        50 schtasks.exe 1 46->50         started        process22
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f19a795a01ec22eb27174da923ca0721e22baa7f0982059b0e644c76b6154a3f/
Threat name:
Win32.Trojan.Barys
Create hunting rule
Status:
Malicious
First seen:
2022-07-01 22:32:05 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6gnhswqb5qrowjyxjwushsqhehrcxkt7bgbalgyomrghnnqvji7q._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence spyware stealer
Link:
https://tria.ge/reports/220704-mcjb7agdfm/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Unpacked files
SH256 hash:
f19a795a01ec22eb27174da923ca0721e22baa7f0982059b0e644c76b6154a3f
MD5 hash:
d178077acbb10e9fc1eae2e8dbc008ef
SHA1 hash:
2040f567dbde0513a67a619a25422314288e83ac
Link:
https://www.unpac.me/results/3726a1ef-d0dc-4c35-af69-2aa84ec0e614/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f19a795a01ec/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Hive

Executable exe f19a795a01ec22eb27174da923ca0721e22baa7f0982059b0e644c76b6154a3f

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2253751/

Comments


Avatar
zbet commented on 2022-07-04 10:18:41 UTC

url : hxxp://185.112.83.111/uangelll.exe