MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f54a8831bb18bebc4d0da8f21487b8dcefafa30e327cf531e6f534d44cea3e6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f54a8831bb18bebc4d0da8f21487b8dcefafa30e327cf531e6f534d44cea3e6c
SHA3-384 hash: ec08fba12c9307b3bd47bda0567cf964e6f0fb7f238ca528991b523ff4fc474ff2a78be933cb1dde52d81189c8c458d7
SHA1 hash: 94b8677f889bbd3cafe2c202eacc15419d621c0c
MD5 hash: dcc8df43fa62d34d924ac86fed696923
humanhash: oregon-victor-island-april
File name:dcc8df43fa62d34d924ac86fed696923
Download: download sample
File size:2'400'235 bytes
First seen:2022-07-14 05:32:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ab9ff6e4872ea2766a5f5c6af5649e9d (20 x CryptOne, 13 x RedLineStealer, 6 x RecordBreaker)
ssdeep 49152:VJ4ot1FpVjTUs6kinz/U0RS0vbSuA3B0WMb09:VJ4cDTUsFsjU0R7zSfxBMu
Threatray 154 similar samples on MalwareBazaar
TLSH T12CB56809A187E27BFCED08A7455081D0C29C7FBA7B528DCDE93AC686141F442F7B6D86
TrID 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10523/12/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter openctibr
Tags:exe OpenCTI.BR Sandboxed

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/288191/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Steam.28157.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/62cfaa9e8dab2096b997a7de/reports/1a462553-2b76-410a-ad1d-8f276add4011/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4bc177bf-c1b9-4a8d-8268-46aecb17dca0
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1031977
Signature
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 664471 Sample: YTD4UFXF6H Startdate: 15/07/2022 Architecture: WINDOWS Score: 56 22 Multi AV Scanner detection for dropped file 2->22 24 Multi AV Scanner detection for submitted file 2->24 9 YTD4UFXF6H.exe 8 2->9         started        process3 file4 20 C:\Users\user\AppData\Local\Temp\DGyP2l.9, PE32 9->20 dropped 12 control.exe 1 9->12         started        process5 process6 14 rundll32.exe 12->14         started        process7 16 rundll32.exe 14->16         started        process8 18 rundll32.exe 16->18         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f54a8831bb18bebc4d0da8f21487b8dcefafa30e327cf531e6f534d44cea3e6c/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-07-09 17:04:00 UTC
File Type:
PE (Exe)
Extracted files:
56
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6vfiqmn3dc7lytinvdzbjb5y3tx27iyogj6pkmpg6u2nithkhzwa._file
Verdict:
malicious
Similar samples:
06a8a0cdefdff7c5fea9e0597c88458b16165963a9b0e2a3ae6c6920148b077d
1813421d5c1ef2be1cce2ea7716850f675c86600f1182465794583943706a8c7
3d10fa199856942dc50bb810376aa0e06a08ad01699871f945c7e3fe6198266f
500f46f7dff03b5ac4559c89b3dfc79403c89f177443115bd8e6a04403b1b91a
868bb2b1387c06898cc942fc7a2858a19c907622379e9705eeed3591c488cdb9
938c6ed84dd404ed8129ef773cc695ddecfb29203e34189760324caa569dfc97
a0dc657791e6bf1267c8ccb48f337569d9b77f46922c5dd4761010fc7b8f94a6
cbe35192c04f83d4d3b179a8c229047ade740aac3785e198cd0fdb00c2bf91e5
eba009319ed5e3e7a1350fc1464cc99aafb6405f0db3385c080cd0db10ce97c5
+ 144 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/220714-f8xq5abac8/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Unpacked files
SH256 hash:
f54a8831bb18bebc4d0da8f21487b8dcefafa30e327cf531e6f534d44cea3e6c
MD5 hash:
dcc8df43fa62d34d924ac86fed696923
SHA1 hash:
94b8677f889bbd3cafe2c202eacc15419d621c0c
Link:
https://www.unpac.me/results/16692cd6-0771-48bc-94d8-1bb01f347a2a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f54a8831bb18bebc4d0da8f21487b8dcefafa30e327cf531e6f534d44cea3e6c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe f54a8831bb18bebc4d0da8f21487b8dcefafa30e327cf531e6f534d44cea3e6c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2254147/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/288191/

Comments