MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2cf70bdc4931203b1b0d66062a5c7da8e7f6e45eb83c3f8f877b35c515a80d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2cf70bdc4931203b1b0d66062a5c7da8e7f6e45eb83c3f8f877b35c515a80d4
SHA3-384 hash: e9e1f8e1b03d7fbc6f69d636d3b12160baa161ab8e1e326e5782e6464642886decd4b95f488cba75d57553572aa14d7e
SHA1 hash: 158c576e3e35b96c56a06153076f1fb3edc06b66
MD5 hash: bf962b701df6b03c9f9e4de42c057471
humanhash: queen-july-michigan-enemy
File name:bf962b701df6b03c9f9e4de42c057471.exe
Download: download sample
File size:4'947'699 bytes
First seen:2022-12-21 17:59:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ab9ff6e4872ea2766a5f5c6af5649e9d (20 x CryptOne, 13 x RedLineStealer, 6 x RecordBreaker)
ssdeep 98304:4J4xahbx26J9MTr2/omY1SsU6HN5mGU6w0SVu3noq+wzWP87z7FCp:4JNRJa+/omYwsZzmG3BWu3oqkazRCp
Threatray 719 similar samples on MalwareBazaar
TLSH T1D136331A69E089B2D83214798BE19671193D3D912F739DEF9365364C4F302D0BB3BAE1
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bf962b701df6b03c9f9e4de42c057471.exe
Verdict:
Suspicious activity
Analysis date:
2022-12-21 18:09:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3793f1fa-307b-48ec-80aa-5d0ba097de89

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/348824/
Detection(s):
Win.Malware.Fugrafa-9938779-0
Create hunting rule

SecuriteInfo.com.Variant.Fugrafa.249470.10364.14457.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Sending a custom TCP request
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/63a349b79f7f5520b7806d61/reports/b08d36d1-838d-404d-b3a6-8802c66be17d/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b97a79c4-d66c-4a01-b2ca-33e4c4fd7615
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
39 / 100
Link:
https://www.joesandbox.com/analysis/1138863
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2cf70bdc4931203b1b0d66062a5c7da8e7f6e45eb83c3f8f877b35c515a80d4/
Threat name:
ByteCode-MSIL.Backdoor.DCRat
Create hunting rule
Status:
Malicious
First seen:
2022-12-21 18:00:12 UTC
File Type:
PE (Exe)
Extracted files:
66
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6lhxbpoesmjahmnq2zqgfjoh3khh63sf5ob4h6hyo6zvyuk2qdka._file
Verdict:
malicious
Similar samples:
049c85c420d5b7b01316bd54cac073421f0f2a6d3af1dc6bf49a494bb9356c02
137d12afa2ddc9fb0f217f2f59c560d4d123ed0a5ef00fe942f6f5fe134ad976
2551a9e1052a5b3cfcef38482db2a1b0d2b85f3889b0ebc9b0a9a77bbadc940d
70caeb1acf2902a83cc604e44bffed2b43c0698a5e101f12b6f1a6f9eeccc546
8725f5edcadc9327d76c8d87e9ad054f7a4acc78f66c8cccd5272472f5201f46
d2bb9f5fab68fab2a4247031c1c4254f54f0e59a237f44a73390da90d87cec58
d5234d480c203df8e7f07086c0fb4c39a6a11909dfe2e5e33b98cb382d2e1964
e9b5861c31edac2ccbf35a953c768ef15d221b448102123485ace59253388985
f8ba98c4f7f9ccf0520492b17b56a57e69c7624e497fca78007766cdce05b947
+ 709 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/221221-wlcensfh6t/
Behaviour
Modifies Internet Explorer settings
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
f2cf70bdc4931203b1b0d66062a5c7da8e7f6e45eb83c3f8f877b35c515a80d4
MD5 hash:
bf962b701df6b03c9f9e4de42c057471
SHA1 hash:
158c576e3e35b96c56a06153076f1fb3edc06b66
Link:
https://www.unpac.me/results/ee28bcd9-928e-4453-ba85-9cf1f45c91a0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f2cf70bdc4931203b1b0d66062a5c7da8e7f6e45eb83c3f8f877b35c515a80d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe f2cf70bdc4931203b1b0d66062a5c7da8e7f6e45eb83c3f8f877b35c515a80d4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2261300/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/348824/

Comments