MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f357e878cec01ecf2c0f2132c1b02865bb7b972fc9f6f639a7e1ae496c01c69c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f357e878cec01ecf2c0f2132c1b02865bb7b972fc9f6f639a7e1ae496c01c69c
SHA3-384 hash: 9c757b5d35264f76358f9b7f3b10477b4236a75bf627071d78cfa79271217c347353cd4232f1a180b57b519f4d5cd425
SHA1 hash: 43e272e33b8844c843c98eae6b57df061f563287
MD5 hash: 1ba7db783e31bb8c6dc66b5a411a6ec9
humanhash: venus-aspen-mexico-music
File name:SecuriteInfo.com.Win32.InjectorX-gen.20684.9178
Download: download sample
File size:2'587'018 bytes
First seen:2023-09-10 02:34:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 30d1665d4c796f53fba13defcdef7cf1 (2 x Metasploit, 1 x Meterpreter)
ssdeep 49152:xWhlkLBfJXAEX8g0MgwMpYjfqvYtw91EqMqG3j2s6TNeovMa+DP:xWhl0BfKE501lYjq9EqMqG3jnovYP
Threatray 673 similar samples on MalwareBazaar
TLSH T176C52313BBD081B2D7622A320F749B27897DF4201F55CACF6391CD6ED9316C2A536B62
TrID 88.3% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
4.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.0% (.EXE) Win32 Executable (generic) (4505/5/1)
0.9% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon b3b3b371716b93b3 (25 x CryptOne, 12 x RemcosRAT, 6 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
281
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.InjectorX-gen.20684.9178
Verdict:
Malicious activity
Analysis date:
2023-09-10 02:37:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7882cfd8-9efb-461a-8d9a-b2ef52627d4d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/447680/
Detection(s):
SecuriteInfo.com.Win32.InjectorX-gen.20684.9178.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Gathering data
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Uztuby
Link:
https://www.hybrid-analysis.com/sample/f357e878cec01ecf2c0f2132c1b02865bb7b972fc9f6f639a7e1ae496c01c69c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/da9f3321-0d81-4167-9056-092fce0543f2
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1306759
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1306759 Sample: SecuriteInfo.com.Win32.Inje... Startdate: 10/09/2023 Architecture: WINDOWS Score: 52 24 Machine Learning detection for sample 2->24 26 Machine Learning detection for dropped file 2->26 9 SecuriteInfo.com.Win32.InjectorX-gen.20684.9178.exe 3 8 2->9         started        process3 file4 22 C:\Users\user\AppData\Local\Temp\gVMmJ.cpl, PE32 9->22 dropped 12 control.exe 1 9->12         started        process5 process6 14 rundll32.exe 12->14         started        signatures7 30 Tries to detect sandboxes / dynamic malware analysis system (file name check) 14->30 17 rundll32.exe 14->17         started        process8 process9 19 rundll32.exe 17->19         started        signatures10 28 Tries to detect sandboxes / dynamic malware analysis system (file name check) 19->28
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f357e878cec01ecf2c0f2132c1b02865bb7b972fc9f6f639a7e1ae496c01c69c/
Threat name:
Win32.Trojan.Uztuby
Create hunting rule
Status:
Malicious
First seen:
2023-09-10 03:57:31 UTC
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6nl6q6goyapm6lapeezmdmbimw5xxfzpzh3pmonh4gxes3aby2oa._file
Verdict:
unknown
Similar samples:
0ae2be648fab712257457725c0bca30f2490b056f7f1f546746253dd72c1bd44
2721439cbbca5e0afe5e8cbb14baa45fd273daf5b321b1f01a7feff5dd177b3d
5c2d49e0dc75cd90f9684bc374d6496d43b4e67de0d743381002a61745f89642
7fea4d10ed74e793361978395459912b36a3a7b80fc69cdeaa5a84a399685d96
8453d969e67368cbee4faf194eddc3dd42b6b590bba07bc0be0d360d272c7d8b
9abd2d92775e67d961f0d0ac7d776e3440f4bf68fea532d35c2b746efccb7252
b4ca413f722daa7f23e077294f5526522e4fa4d191daa2441f3049f967f91c61
db52d11ac4d0ed5f18ad60812c3df5b3f2a17cecf0d430e1fc77b492e8abdf30
ee7b765509c38a676e9708a43dd722209135d7aae6452986ec6cf03c3f23dea0
fd1c0ccbda97135c2ad51edd39ce16a14ea1368db932b8f394b11a005a2f750d
+ 663 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230910-c21mnaeh77/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Unpacked files
SH256 hash:
cc24947ae0303502040e5192892840cfe1ac45bb4d2e5c1bf0df72adb8d73f75
MD5 hash:
7f5f9702355b1457c4f254c11b482dde
SHA1 hash:
96e0474fa2dff75c5dfc848a4be22325ee20b3ea
Link:
https://www.unpac.me/results/d42005ea-b70e-4c9d-9b44-6a6e3896e22c/
SH256 hash:
f357e878cec01ecf2c0f2132c1b02865bb7b972fc9f6f639a7e1ae496c01c69c
MD5 hash:
1ba7db783e31bb8c6dc66b5a411a6ec9
SHA1 hash:
43e272e33b8844c843c98eae6b57df061f563287
Link:
https://www.unpac.me/results/d42005ea-b70e-4c9d-9b44-6a6e3896e22c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f357e878cec01ecf2c0f2132c1b02865bb7b972fc9f6f639a7e1ae496c01c69c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe f357e878cec01ecf2c0f2132c1b02865bb7b972fc9f6f639a7e1ae496c01c69c

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/447680/
  
URLhaus
https://urlhaus.abuse.ch/url/2710864/
  
Delivery method
Distributed via web download

Comments