MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f58d2071a2fdaea27d814e788e002fe5da63843546f22c255eceade162323ce1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Lucifer


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f58d2071a2fdaea27d814e788e002fe5da63843546f22c255eceade162323ce1
SHA3-384 hash: 917da15bdc205045eae3237d607313034563b005f3f74f2ccdeaf3de93c197a47e60c0261c9bf78c0765fb39ed6bba87
SHA1 hash: 915306065ac728701614ed4fe03a03168d95bb84
MD5 hash: 03fa2aa90ad1ce098de68893d83f701d
humanhash: lion-missouri-quebec-fruit
File name:03fa2aa90ad1ce098de68893d83f701d
Download: download sample
Signature Lucifer
Create hunting rule
File size:1'262'080 bytes
First seen:2021-09-14 22:43:26 UTC
Last seen:2021-09-15 01:55:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:e5EzeaAcdXmZM1KNrtTCXSnny5doEqXfei/ElljPFnF42s2Bx0teS:0244/gPHoIuS
Threatray 98 similar samples on MalwareBazaar
TLSH T17345F45536E9A09FB3B7BE7A8BC5F91F0637F6635D01548C31A1838A8512881CFB2B35
Reporter zbetcheckin
Tags:32 exe Lucifer

Intelligence

File Origin
# of uploads :
4
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
03fa2aa90ad1ce098de68893d83f701d
Verdict:
Malicious activity
Analysis date:
2021-09-14 22:44:51 UTC
Tags:
trojan loader
Link:
https://app.any.run/tasks/d783a0bb-9f9d-488c-ad02-86184c12ca9e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/187934/
Detection(s):
SecuriteInfo.com.Trojan.ClipBankerNET.19.26228.170.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Creating a process from a recently created file
Launching a process
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a window
Delayed writing of the file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/61751288a9d585e6d5370e72/reports/1592643a-a614-4355-8da0-cb2cb5c39d4f/overview
Malware family:
JigsawLocker
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/156d2d9f-a705-4b7a-87ee-7c5f5b56bea6
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/851004
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f58d2071a2fdaea27d814e788e002fe5da63843546f22c255eceade162323ce1/
Threat name:
ByteCode-MSIL.Trojan.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-09-12 19:13:16 UTC
AV detection:
11 of 27 (40.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6wgsa4nc7wxke7mbjz4i4abp4xnghbbvi3zcyjk6z2w6cyrshtqq._file
Verdict:
malicious
Similar samples:
03b209015fc672da7e08359236d6fd0197f53e4ef9ccfc690380cf422961106a
Lucifer
1618dcdf8e1300e53b57a5579299b14ad0033f04fe5abed32c7c4b1bc01e187d
Lucifer
23d87add58cf094c020bd57067f2cbcfdb9908682e0a60b54c0901f177afc5c9
Lucifer
33504964352cf78797b60fccf134fd54ef09e3e5547da904115cd18c8dcf58f2
Lucifer
4a6f525c5728145789924c96d5c8786dde14054a1d2a39db9c22fa8b30db0d6e
Lucifer
7578b1f217fca3612bbabadca671494f35cbada8d58fc11c68092477c99ec084
Lucifer
a5e7fc18a5e344a7f398d03f8b4e2cf0f2579e4d70c90915376e066cec01505a
Lucifer
c47be8455733bb50fb191d747a5b7c4427fae086296ffbedc2cd7c235bd194bf
Lucifer
d848ad80c61b73f73f41e7f0f17b0eb53a70c4118450c1cf68210c592b289174
Lucifer
f29908da1b8065356704e746f9e282378a7e5ae65c753e2e9fe02b214b5b792b
Lucifer
+ 88 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat persistence rat
Link:
https://tria.ge/reports/210914-2ns34agde8/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Checks BIOS information in registry
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Async RAT payload
AsyncRat
Unpacked files
SH256 hash:
f58d2071a2fdaea27d814e788e002fe5da63843546f22c255eceade162323ce1
MD5 hash:
03fa2aa90ad1ce098de68893d83f701d
SHA1 hash:
915306065ac728701614ed4fe03a03168d95bb84
Link:
https://www.unpac.me/results/8e08f78e-a7ea-45a2-9d2a-af496208d7ab/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f58d2071a2fdaea27d814e788e002fe5da63843546f22c255eceade162323ce1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Lucifer

Executable exe f58d2071a2fdaea27d814e788e002fe5da63843546f22c255eceade162323ce1

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1620278/
Cape
Cape
https://www.capesandbox.com/analysis/187934/

Comments


Avatar
zbet commented on 2021-09-14 22:43:26 UTC

url : hxxp://sherence.ru/slFZvqw6JB8bsDt.exe