MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4dfc047ed766b96a6de718ea96fefee921556caa4ce6171fbe407284cbba2f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Chthonic


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4dfc047ed766b96a6de718ea96fefee921556caa4ce6171fbe407284cbba2f3
SHA3-384 hash: 0328bb278ade470016ca737ba6406a36c4d76243ad63f65c0c45463210319408c3e469d3425477f81c47b28b408074ac
SHA1 hash: 1ff3e9c230a345813b0848d911d80e2150b2df10
MD5 hash: 652ddd26bb95583bfceddba3f0813b9a
humanhash: skylark-equal-idaho-music
File name:chthonic_2.23.18.27.vir
Download: download sample
Signature Chthonic
Create hunting rule
File size:868'408 bytes
First seen:2020-07-19 19:43:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 143f01aac681514f0e86a3ddaa850bc9 (1 x Chthonic)
ssdeep 12288:XQfO3NWjdwnz4KJdXUCf0EiA18AYjTTuj22zGaFI5a:XQ2gl1axe
Threatray 46 similar samples on MalwareBazaar
TLSH 1405E4C2EE53022AE716047DFB9862C4F948AF061F7F4CA3718DFA1E45B3D810A9D665
Reporter tildedennis
Tags:Chthonic


Avatar
tildedennis
chthonic version 2.23.18.27

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/28346/
Detection(s):
SecuriteInfo.com.Trojan.MulDrop11.24003.4169.24662.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Browsefox-6628766-0
Create hunting rule

PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

PUA.Win.Adware.Qjwmonkey-6892535-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/390559
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247494 Sample: chthonic_2.23.18.27.vir Startdate: 20/07/2020 Architecture: WINDOWS Score: 100 52 Antivirus / Scanner detection for submitted sample 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 Detected non-DNS traffic on DNS port 2->56 58 2 other signatures 2->58 6 TWindowsNt.exe 6 2->6         started        10 chthonic_2.23.18.27.exe 1 10 2->10         started        13 autoit3T.exe 2->13         started        15 TWindowsNt.exe 6 2->15         started        process3 dnsIp4 28 C:\Users\user\AppData\Local\...\7A4C7159.tmp, PE32 6->28 dropped 40 5 other files (none is malicious) 6->40 dropped 64 Antivirus detection for dropped file 6->64 66 Detected unpacking (changes PE section rights) 6->66 68 Detected unpacking (overwrites its own PE header) 6->68 17 winver.exe 1 4 6->17         started        50 2.23.18.27 SEABONE-NETTELECOMITALIASPARKLESpAIT European Union 10->50 30 C:\Users\user\AppData\...\TWindowsNt.exe, PE32 10->30 dropped 32 C:\Users\user\AppData\Local\...\6A433669.tmp, PE32 10->32 dropped 34 C:\Users\user\AppData\Local\...\696D6932.tmp, PE32 10->34 dropped 42 4 other files (none is malicious) 10->42 dropped 70 Contains functionality to automate explorer (e.g. start an application) 10->70 72 Creates multiple autostart registry keys 10->72 74 Contains functionality to compare user and computer (likely to detect sandboxes) 10->74 76 Machine Learning detection for dropped file 13->76 36 C:\Users\user\AppData\Local\...\7A563049.tmp, PE32 15->36 dropped 38 C:\Users\user\AppData\Local\...\704A6361.tmp, PE32 15->38 dropped 44 4 other files (none is malicious) 15->44 dropped 78 Writes to foreign memory regions 15->78 22 winver.exe 15->22         started        file5 signatures6 process7 dnsIp8 46 108.61.161.119, 53 AS-CHOOPAUS United States 17->46 48 178.17.170.179, 53 TRABIAMD Moldova Republic of 17->48 24 C:\Users\user\AppData\...\autoit3T.exe, PE32 17->24 dropped 26 C:\Users\user\AppData\Local\Temp\F013.tmp, PE32 17->26 dropped 60 Creates multiple autostart registry keys 17->60 file9 62 Detected non-DNS traffic on DNS port 46->62 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4dfc047ed766b96a6de718ea96fefee921556caa4ce6171fbe407284cbba2f3/
Threat name:
Win32.Trojan.Wauchos
Create hunting rule
Status:
Malicious
First seen:
2019-10-20 00:49:00 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0c80fa8807477cff8c9c3ed7b2a857538f022b1e8829020d09f60bd71f1afd9a
Chthonic
1d452b5f3e5d2b6623d0ca35793dfc051e1bf8b237e360906ed055e819235604
Chthonic
3ee04e378f6430e85f5756093e80b243c2ebbcb9f2ee77cc32acd1cd9e333301
Chthonic
4db9e6043c7ddc8a04114e731a22d16d4cba065931b2cebd4dc61570e5c45c4b
Chthonic
4f79aa8d648c5a999fb91196040b6b68db284ba1b892217563df71db9ae477f3
Chthonic
563ee97396c60bb7d587d98e95d68109cfe9b0a924860bee678e1e4da196bb64
Chthonic
a0fd9cf6002a8f7503dd47682be0dca44ffb66157c910ada1ffc360c2d7d70a6
Chthonic
b1edf0682b7141bf0f7bc1f18a02e74d3b81e2d03aa7427d81761267eabb57d5
Chthonic
d8dbe0a74ff4d70f5633f8177f37c14cd1586d7a658ecf72d05f59261e8ad016
Chthonic
e0a34b9c420ddd930b3f89c13c3f564907dd948e88f668a0fe55ce506220bd73
Chthonic
+ 36 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence ransomware bootkit
Link:
https://tria.ge/reports/200719-7x36jp44cs/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Modifies data under HKEY_USERS
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Adds Run key to start application
Adds Run key to start application
Loads dropped DLL
Loads dropped DLL
Modifies WinLogon to allow AutoLogon
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f4dfc047ed766b96a6de718ea96fefee921556caa4ce6171fbe407284cbba2f3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://zeusmuseum.com/chthonic/
Cape
Cape
https://www.capesandbox.com/analysis/28346/

Comments