MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f52db36593133648786002411f0fe9cde78c3fab4bbb30a628a97e17238b6b87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f52db36593133648786002411f0fe9cde78c3fab4bbb30a628a97e17238b6b87
SHA3-384 hash:	b8e500a58b06fc816faf4fb0b9a392ba20e98859ec78784c2091e5b53eccb41d6c9622ef679391db6d71fd909dc733eb
SHA1 hash:	313068a83134af1255783b97d1bf5f1dcac57c12
MD5 hash:	96830bb485ba0afad1d748c4c3371b6a
humanhash:	virginia-kansas-network-paris
File name:	netspeedmeter.exe
Download:	download sample
File size:	10'365'661 bytes
First seen:	2022-11-23 18:21:34 UTC
Last seen:	2022-11-23 19:33:22 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	5a594319a0d69dbc452e748bcf05892e (21 x ParallaxRAT, 20 x Gh0stRAT, 15 x NetSupport)
ssdeep	196608:b0ZW67zwSGSqzi8FXbC/w9HnDXji0YrS0o8b8VBZ8MlIiiyHhSdKgl1TPr727V00:b0ZW67zOzi7Gjji0h0oFTG8H7gXc00
Threatray	20 similar samples on MalwareBazaar
TLSH	T176A6233BB2BAA13EC15A177105B3976048F77F65FC0A8C2AC7E0450DCF669E01E3A656
TrID	61.8% (.EXE) Inno Setup installer (109740/4/30) 23.4% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 5.9% (.EXE) Win64 Executable (generic) (10523/12/4) 2.5% (.EXE) Win32 Executable (generic) (4505/5/1) 1.6% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
File icon (PE):
dhash icon	076979e8e861631f
Reporter	Anonymous
Tags:	exe FakeInstaller

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

212

Origin country :

EC

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

netspeedmeter.rar

Verdict:

Malicious activity

Analysis date:

2022-11-23 18:18:25 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/4dd4a849-ea65-411e-bbb1-44d676cf6c79

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/337804/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.TrojanX-gen.31631.11148.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for synchronization primitives

Searching for the window

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

overlay packed setupapi.dll shell32.dll

Link:

https://www.filescan.io/uploads/637e64cb559d07a06f470fdc/reports/ba517ce0-0b16-49fe-8f0f-6e5724541073/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Intezer Discord

Malware family:

Discord

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a9765ff2-0e37-42b5-b6a9-977b81713754

Joe Sandbox suspicious

Result

Threat name:

Unknown

Detection:

suspicious

Classification:

spyw.evad

Score:

32 / 100

Link:

https://www.joesandbox.com/analysis/1119992

Signature

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Obfuscated command line found

Tries to harvest and steal browser information (history, passwords, etc)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f52db36593133648786002411f0fe9cde78c3fab4bbb30a628a97e17238b6b87/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2022-11-23 18:22:11 UTC

File Type:

PE (Exe)

AV detection:

10 of 26 (38.46%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6uw3gzmtcm3eq6daajar6d7jzxtyyp5ljo5tbjrivf7boi4lnodq._file

Threatray suspicious

Verdict:

suspicious

Similar samples:

3c044e30aac305079423fef30bd1ebf5ed96967be70f6e1526b70f6bd3cd2208

405628de6b7fd3b43d24ccb4666ac45ec67775f5f097e902103e5fbcdf52ec75

4a78da86088eed90bd838d99d1afd5ceaca6c9c521be450639670f6d06a7fe77

971725f4443df9cf72b74a296e54352bd0f91bf74517fb28980a1916f89d56e2

9fbdcf044aba61ae6c0678b5f83fc4bd8b589ba3a4fd12a5bef53e2ead494eed

b133d412502ab9654837fc898e800503003bdda51480c711838a381aecb99942

cb608822e6b4e11e81235ea5ce36b63719ad03e62f6e0ce3e654e24268f57442

f21fbc70b613bff0b36f68277ec821c2a209e1c203b1eaee021f9b748f4fb0fc

f3adfb055c94c9506a811406f5ffbb6db42dc960a8175065fb0625a62b3fcfd4

+ 10 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/221123-wzwepsdd37/

Behaviour

Suspicious use of WriteProcessMemory

Loads dropped DLL

Executes dropped EXE

UnpacMe 2

Unpacked files

SH256 hash:

ed6a2c414de8824ef6f42deb6e695fcf9f7f53f9280edff731c3b124b9e2e140

MD5 hash:

2e61c8f0c899a2bbf4c03f332751cbb5

SHA1 hash:

189dda1b94734592b56c6e355527f8d3e6041d9d

Link:

https://www.unpac.me/results/dc028476-e568-45be-89ac-e9d4e101ed4b/

SH256 hash:

f52db36593133648786002411f0fe9cde78c3fab4bbb30a628a97e17238b6b87

MD5 hash:

96830bb485ba0afad1d748c4c3371b6a

SHA1 hash:

313068a83134af1255783b97d1bf5f1dcac57c12

Link:

https://www.unpac.me/results/dc028476-e568-45be-89ac-e9d4e101ed4b/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f52db36593133648786002411f0fe9cde78c3fab4bbb30a628a97e17238b6b87

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe f52db36593133648786002411f0fe9cde78c3fab4bbb30a628a97e17238b6b87

(this sample)

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/337804/