MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5657913e8e52fec07fe5604c87997c7f96d708ab90262f6cc65864f85f55160. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5657913e8e52fec07fe5604c87997c7f96d708ab90262f6cc65864f85f55160
SHA3-384 hash: 36b99a596fb2caec0aab130cd02b1a2a8505aa8d4b80651e28ffbeadb10f162cf1ee1ee121d3f2f25825bded804fdb88
SHA1 hash: 2f5cce044713024d87e8b7f2f9ef1c10e0117b74
MD5 hash: 99112d3c5998ecf1a2074e382aee4974
humanhash: don-florida-failed-carolina
File name:99112d3c5998ecf1a2074e382aee4974.exe
Download: download sample
File size:384'512 bytes
First seen:2021-08-13 08:18:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0bf655415ca56259c52a810b423d3c43 (1 x RaccoonStealer, 1 x Smoke Loader)
ssdeep 6144:vpLdBr39BqCowaUGfkRHv9SCMukDW3tBlzZHIqDNt4ORO2Ci:xRF39BqMGfAHF/MukDW3RzZ3IOEi
Threatray 32 similar samples on MalwareBazaar
TLSH T1B984F1E1BA83D83EC081E5F2046896B1472DBA585A14404F67553FAF2E331E346FE3E6
dhash icon 4839b2b0e8c38890 (105 x RaccoonStealer, 38 x Smoke Loader, 33 x RedLineStealer)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
99112d3c5998ecf1a2074e382aee4974.exe
Verdict:
Malicious activity
Analysis date:
2021-08-13 08:28:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0291a0f6-6fc6-46cd-acbe-1ab67e5a7a21

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178925/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.31881.12394.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0ef19210-c7d1-4eae-8a15-be99bc748d39
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/832236
Signature
Contains VNC / remote desktop functionality (version string found)
Creates autostart registry keys with suspicious names
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 464668 Sample: 0U1h58nsHn.exe Startdate: 13/08/2021 Architecture: WINDOWS Score: 92 54 Multi AV Scanner detection for submitted file 2->54 56 Machine Learning detection for sample 2->56 58 Contains VNC / remote desktop functionality (version string found) 2->58 7 0U1h58nsHn.exe 2 4 2->7         started        11 33A2E4F0.exe 2->11         started        13 33A2E4F0.exe 2->13         started        process3 file4 42 C:\ProgramData\...\33A2E4F0.exe, PE32 7->42 dropped 60 Detected unpacking (changes PE section rights) 7->60 62 Detected unpacking (overwrites its own PE header) 7->62 64 Creates autostart registry keys with suspicious names 7->64 15 33A2E4F0.exe 7->15         started        signatures5 process6 dnsIp7 44 ebanat6977769.com 8.209.79.46, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 15->44 46 Multi AV Scanner detection for dropped file 15->46 48 Detected unpacking (changes PE section rights) 15->48 50 Detected unpacking (overwrites its own PE header) 15->50 52 2 other signatures 15->52 19 WerFault.exe 9 15->19         started        22 WerFault.exe 9 15->22         started        24 WerFault.exe 9 15->24         started        26 4 other processes 15->26 signatures8 process9 file10 28 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 19->28 dropped 30 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 22->30 dropped 32 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 24->32 dropped 34 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 26->34 dropped 36 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 26->36 dropped 38 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 26->38 dropped 40 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 26->40 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f5657913e8e52fec07fe5604c87997c7f96d708ab90262f6cc65864f85f55160/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2021-08-13 08:18:06 UTC
AV detection:
26 of 46 (56.52%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
32e30f494b7bb01ab18836029193c2a79fb63795f978eeed31103f368c6d8fba
35f0fd2e322b088525d860105208e5cdd39f85b0016b56d9e76cff8bbc542179
5521400dffe660536524b06e28edc0805136092457722f3e1246a8749a0a7471
74e82ea63f25fdb065ab8d4df1d69f9a22d1c1a76edf609f2f22d5080411fe4c
786b9cb2fa5e78e4bc0d9e67e6f90c0229b150bacfd3e75cf46a9c3a67d57a67
82d08c29cb4e61dbe7455ff966f20e33f16e941341790363c00c3d261d4def11
9f3805a821c12122b67395c50e390d35c70e83d5b82a6e5741e56c0087960a60
a8e2a996c913eb390bd0074d461a97156ad7395ae5ca856c2a6e6c14be534e2d
cceb5da1ebba042d949f4afef5f5e4638826493201564245be0448920dac639c
+ 22 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/210813-9q1v9krbme/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
8fe1877b2cb312eaa3b1fd4b10bcd9c4050a86f55b602704db3a6a453ff0e7a8
MD5 hash:
2ec55de670faf40bbce8624884512519
SHA1 hash:
de87552e3af4bd3f9cd7baa93b652fc21c60b952
Link:
https://www.unpac.me/results/95e3e652-4ca0-496e-a147-7094e8df7683/
SH256 hash:
f5657913e8e52fec07fe5604c87997c7f96d708ab90262f6cc65864f85f55160
MD5 hash:
99112d3c5998ecf1a2074e382aee4974
SHA1 hash:
2f5cce044713024d87e8b7f2f9ef1c10e0117b74
Link:
https://www.unpac.me/results/95e3e652-4ca0-496e-a147-7094e8df7683/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f5657913e8e52fec07fe5604c87997c7f96d708ab90262f6cc65864f85f55160

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe f5657913e8e52fec07fe5604c87997c7f96d708ab90262f6cc65864f85f55160

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1525649/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/178925/

Comments