MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5a3c92032bc45af8e374b619a5b6d046e6c3eadc83dc84595bffc4d6acab717. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5a3c92032bc45af8e374b619a5b6d046e6c3eadc83dc84595bffc4d6acab717
SHA3-384 hash: 1787a8779134916656f4343bab1ff015de481f45c9501f8be2ae7d69476271fdc89c6a7bbe8178fdd48a3fbd45ef3074
SHA1 hash: 3aa0318d4917f72fa7f7045852599c922cdb9fcf
MD5 hash: 90ded0a957a3ea7377ae8c658c88b26a
humanhash: tennessee-eight-utah-nine
File name:Our New Order May 03 2021 at 9.27_PVV550_TXT.pif
Download: download sample
File size:1'290'240 bytes
First seen:2021-05-03 12:55:08 UTC
Last seen:2021-05-06 10:11:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'664 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 1536:mKg2dFgJg4gSgygrgsgEg4gsgHgog8g/gfgEgvgDgrglg7gfgMg+gFgsg3gtgHgJ:m9jzIEPeMK3kkBQTxanannm
Threatray 36 similar samples on MalwareBazaar
TLSH A6555188554C245C72773EE5EACC5BA88FA3D0F32DBFD0061A68195A6E95FC0DD70B82
Reporter abuse_ch
Tags:pif

Intelligence

File Origin
# of uploads :
3
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/148478/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.9275.20376.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Creating a process with a hidden window
Launching a process
Unauthorized injection to a recently created process
Adding an access-denied ACE
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Sending a custom TCP request
Creating a window
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/707876
Signature
.NET source code contains very large strings
Contains functionality to hide a thread from the debugger
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 402857 Sample: Our New Order May 03 2021 a... Startdate: 03/05/2021 Architecture: WINDOWS Score: 72 25 Multi AV Scanner detection for submitted file 2->25 27 Machine Learning detection for sample 2->27 29 Initial sample is a PE file and has a suspicious name 2->29 31 2 other signatures 2->31 7 Our New Order May 03 2021 at 9.27_PVV550_TXT.exe 3 2->7         started        process3 signatures4 33 Hides threads from debuggers 7->33 35 Injects a PE file into a foreign processes 7->35 10 cmd.exe 1 7->10         started        12 Our New Order May 03 2021 at 9.27_PVV550_TXT.exe 2 7->12         started        15 WerFault.exe 23 9 7->15         started        17 Our New Order May 03 2021 at 9.27_PVV550_TXT.exe 7->17         started        process5 dnsIp6 19 conhost.exe 10->19         started        21 timeout.exe 1 10->21         started        23 103.133.109.176, 49733, 7254 VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN Viet Nam 12->23 process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f5a3c92032bc45af8e374b619a5b6d046e6c3eadc83dc84595bffc4d6acab717/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-05-03 11:53:24 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6wr4sibsxrc27drxjnqzuw3narxgypvnza64qrmvx76e22wkw4lq._file
Verdict:
unknown
Similar samples:
33378b4ff2e8e5d64380bf24d787e4cae639cd41ceafbeeff82d7cf7a74be69a
587df9036ffed6807865686f406ff26511a466562129803f75c5b8cd7e0f9839
728beffcc4c6b9cab51ed5b4a459cc6f996ba0eb1a1e8c29f567de5701abcd91
7dc99e0fc03dc0936799d5328e864b67dd8c92d3ae90798cc542449e2f0d55da
a4f9a06d39f0b20bb9e04aab75db64d3cf18ee2025a890471536415b6f18fcd3
abfd412e775e8a81efbd61484a67de9aed008c0e51910d9d8a9051c4ea9856b3
c4ee3e5cecf3510d88b59f4122e88f50dc99a761338dd1f8fc3eff6bfed2e005
cde072db2b4374550769689ef072dba357436e36d2e75c1398d24896e0deaeb1
e8cac456b3e4a072d16142f0dd9f9b0500013cfefe7359e4293d4cff61f9eaf7
f3c279e61de77236f3390c91dee09f02aa01974e14e429426fa174e0ff8a7512
+ 26 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/210503-v2n9e5lr22/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
17e6c62dbfa103d01b189aada662ed9ce5f59946e56daafb9bbf3bac2c50b776
MD5 hash:
615792be1eab0674223f6aeb22df9c61
SHA1 hash:
3bfda34287ed1aa113d199781f033506389a2ca8
Link:
https://www.unpac.me/results/fd41edf2-bce7-4bde-8fe1-2bfbcd1ce709/
SH256 hash:
8e97bbdb2eef8205eb046f068c725fcfe17b6727caf4f44cbbfae37b0f248088
MD5 hash:
86ae7de0090c75839d2edda8a751fd0a
SHA1 hash:
b93ff55a289d5dfbbeac9a936b2ac4dba4e3cc55
Link:
https://www.unpac.me/results/fd41edf2-bce7-4bde-8fe1-2bfbcd1ce709/
SH256 hash:
3dcb079725a8b41c93f2360bf10f7be55d9b727b7c705a011469e1057938018a
MD5 hash:
21142ca23ef1fa5875698fa87eed47df
SHA1 hash:
1cb2c1602841be5d1e5612a61aed5056578e0106
Link:
https://www.unpac.me/results/fd41edf2-bce7-4bde-8fe1-2bfbcd1ce709/
SH256 hash:
f5a3c92032bc45af8e374b619a5b6d046e6c3eadc83dc84595bffc4d6acab717
MD5 hash:
90ded0a957a3ea7377ae8c658c88b26a
SHA1 hash:
3aa0318d4917f72fa7f7045852599c922cdb9fcf
Link:
https://www.unpac.me/results/fd41edf2-bce7-4bde-8fe1-2bfbcd1ce709/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.98
Link:
https://yomi.yoroi.company/submissions/f5a3c92032bc45af8e374b619a5b6d046e6c3eadc83dc84595bffc4d6acab717

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/148478/

Comments