MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4b17c300b847ffaee23c8391d8e9816f97e1cecf6ea453dafd3e57da73fd32a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments 1

SHA256 hash:	f4b17c300b847ffaee23c8391d8e9816f97e1cecf6ea453dafd3e57da73fd32a
SHA3-384 hash:	884940f0a93ae7032f9c28c92f436771740eb6f40101c51ce107034e40ee6242ecfe9ee578d374e3e1ba523906298e4b
SHA1 hash:	cfed222a1be8e01e921f2b912cd2aaf50599e602
MD5 hash:	ebd57653d474ebeb5c5df2c19df6912b
humanhash:	alaska-carolina-beer-maryland
File name:	ebd57653d474ebeb5c5df2c19df6912b
Download:	download sample
File size:	6'226'268 bytes
First seen:	2023-09-02 04:24:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0130bd85ad1b4bdd4689797fdfbef9b9
ssdeep	98304:3hzMQFcIKsJatIXw4KpLwrWA5dgedb7a2ZO3u0f9gedfjp6/dgWxVwnSM61n3:3hzrFcIKdQlCwrWNeF7JZO3ucgedfj0R
TLSH	T1E156333D0D91EDF6E5244C7535212A54E7B18A0AA6F4314FFB346D5BEF0B62B8832D22
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter	zbetcheckin
Tags:	64 exe

Intelligence

File Origin

# of uploads :

# of downloads :

284

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ebd57653d474ebeb5c5df2c19df6912b

Verdict:

Malicious activity

Analysis date:

2023-09-02 04:26:22 UTC

Tags:

trojan

Link:

https://app.any.run/tasks/0233c80a-06b1-4749-840b-a5db12860628

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/445725/

Detection(s):

SecuriteInfo.com.Trojan.Win64.Crypt.2340.22289.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for analyzing tools

Searching for the window

Sending an HTTP GET request

Launching the default Windows debugger (dwwin.exe)

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/f4b17c300b847ffaee23c8391d8e9816f97e1cecf6ea453dafd3e57da73fd32a

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/f7799708-94ad-46e3-84ad-05658d742366

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1302034

Signature

Antivirus / Scanner detection for submitted sample

Hides threads from debuggers

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f4b17c300b847ffaee23c8391d8e9816f97e1cecf6ea453dafd3e57da73fd32a/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6syxymalqr77v3rdza4r3duyc34x4hhm63vekpnp2psx3jz72mva._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

9/10

Tags:

evasion spyware stealer trojan

Link:

https://tria.ge/reports/230902-e1dgvabc72/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Checks BIOS information in registry

Reads user/profile data of web browsers

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Unpacked files

SH256 hash:

f4b17c300b847ffaee23c8391d8e9816f97e1cecf6ea453dafd3e57da73fd32a

MD5 hash:

ebd57653d474ebeb5c5df2c19df6912b

SHA1 hash:

cfed222a1be8e01e921f2b912cd2aaf50599e602

Link:

https://www.unpac.me/results/94b529c4-ecd3-4b28-af60-fc6dc3ee8299/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f4b17c300b847ffaee23c8391d8e9816f97e1cecf6ea453dafd3e57da73fd32a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe f4b17c300b847ffaee23c8391d8e9816f97e1cecf6ea453dafd3e57da73fd32a

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2708932/

Cape

https://www.capesandbox.com/analysis/445725/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-09-02 04:24:03 UTC

url : hxxp://193.233.255.9/lend/Install_WinX64X86.exe