MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f43ef0a7b6336e9e6eef6ee9f7049615c6b33b53d402d19fbb0b1575f6c2b1b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	f43ef0a7b6336e9e6eef6ee9f7049615c6b33b53d402d19fbb0b1575f6c2b1b4
SHA3-384 hash:	a93875192dd6acc3d71c0123eee8177046b5a9b52aad8ebe9251f1f95bced3b1f2d6946be550b3f50e50b71f661696a4
SHA1 hash:	741905e50120cfd04b9e1741779c2b24b06b0899
MD5 hash:	a5c9273b92a1040c1437e7caee92fedc
humanhash:	uranus-lamp-maryland-triple
File name:	a5c9273b92a1040c1437e7caee92fedc.bin
Download:	download sample
File size:	42'496 bytes
First seen:	2024-04-23 23:35:51 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2cf082f78fe51269f192ea43727c71c1
ssdeep	768:avY+jvuwHq3wmkTrWLGBx7OM05Ylta6+qExhcg2UoZZRS8UOz:avYWvuP3wHTrW6BAC3+nzcg2T1UOz
TLSH	T187138DDABBE1C8F3DCD140701669976627EEDD2380349E47C3284A903535AE3912FE6B
Reporter	tildedennis
Tags:	exe prg

tildedennis

prg version 1.0.4.15

Intelligence

File Origin

# of uploads :

# of downloads :

285

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

f43ef0a7b6336e9e6eef6ee9f7049615c6b33b53d402d19fbb0b1575f6c2b1b4.exe

Verdict:

Suspicious activity

Analysis date:

2024-04-24 04:49:37 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e3d5634c-08bc-427f-8d8b-7645130677b8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/f43ef0a7b6336e9e6eef6ee9f7049615c6b33b53d402d19fbb0b1575f6c2b1b4

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/0c0131f0-0961-43cc-a102-4039a396ae44

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1430652

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f43ef0a7b6336e9e6eef6ee9f7049615c6b33b53d402d19fbb0b1575f6c2b1b4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f43ef0a7b6336e9e6eef6ee9f7049615c6b33b53d402d19fbb0b1575f6c2b1b4/

Threat name:

Win32.Trojan.Zeus

Status:

Malicious

First seen:

2023-07-31 04:40:57 UTC

File Type:

PE (Exe)

AV detection:

35 of 38 (92.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6q7pbj5wgnxj43xpn3u7obewcxdlgo2t2qbndh53bmkxl5wcwg2a._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/240423-3ljx3sch66/

Behaviour

Program crash

Unpacked files

SH256 hash:

f43ef0a7b6336e9e6eef6ee9f7049615c6b33b53d402d19fbb0b1575f6c2b1b4

MD5 hash:

a5c9273b92a1040c1437e7caee92fedc

SHA1 hash:

741905e50120cfd04b9e1741779c2b24b06b0899

Link:

https://www.unpac.me/results/a05d0b32-45cb-4c4c-96d7-105935bd0e19/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f43ef0a7b6336e9e6eef6ee9f7049615c6b33b53d402d19fbb0b1575f6c2b1b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	zbot Create hunting rule
Author:	malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Link

https://zeusmuseum.com/prg/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
SECURITY_BASE_API	Uses Security Base API	advapi32.dll::GetPrivateObjectSecurity
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CloseHandle
WIN_BASE_EXEC_API	Can Execute other programs	kernel32.dll::SetConsoleMode
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::RemoveDirectoryA
WIN_BASE_USER_API	Retrieves Account Information	advapi32.dll::LogonUserA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample