MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8462784c938c32e326abdba379d8944c9600f34ad85737efd6e7866d0bedff8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8462784c938c32e326abdba379d8944c9600f34ad85737efd6e7866d0bedff8
SHA3-384 hash: 2eb3e7d9803fd9c892ab7b9f690729c25b0d32c591a89b7ca76d2bed9b2dfbe37e502e68b6590bf006ca57afec0961b8
SHA1 hash: ecf7affe7a1d34182f3e44ca8d1f7a49595f81dc
MD5 hash: 1ba42ca00e1c4c79dda860c5c24ede8c
humanhash: alabama-east-quiet-shade
File name:1ba42ca00e1c4c79dda860c5c24ede8c.exe
Download: download sample
File size:4'034'048 bytes
First seen:2022-03-11 19:32:27 UTC
Last seen:2022-03-11 21:51:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 511cff895609a1cf1f0a80aeee92ffc8 (3 x ZeuS, 2 x CryptBot)
ssdeep 98304:TUx5FxGgrp5oEyEEUGe5Lh32LEvjL/Z6vv/pYzO7Y5R6n52:Gv15c7sh+EivBZYO52
Threatray 9'914 similar samples on MalwareBazaar
TLSH T1F01633924D54E588C8BCC1722F17EC0936315A1AA1F51CBEE19F7EE684A710D6387E3E
File icon (PE):PE icon
dhash icon a223dcf8f2f6fe1c (1 x CryptOne)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
193
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/249686/
Detection(s):
SecuriteInfo.com.Variant.Zusy.416570.3725.20726.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
Creating a window
Running batch commands
Creating a process with a hidden window
Sending a custom TCP request
Creating a file in the %temp% subdirectories
Using the Windows Management Instrumentation requests
Reading critical registry keys
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
autoit packed
Link:
https://www.filescan.io/uploads/622ba3f4dfdfa8501c8d78b9/reports/0fe98296-d48f-4634-9075-c9b370ed229d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Zeus
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0c1a1bb9-45e6-4c9e-a42b-45b1e7da794c
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/955212
Signature
Antivirus / Scanner detection for submitted sample
Binary is likely a compiled AutoIt script file
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sigma detected: Copying Sensitive Files with Credential Data
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 587699 Sample: NeyAz3tADZ.exe Startdate: 11/03/2022 Architecture: WINDOWS Score: 92 34 hogvxu52.top 2->34 36 Antivirus / Scanner detection for submitted sample 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 Binary is likely a compiled AutoIt script file 2->40 42 3 other signatures 2->42 8 NeyAz3tADZ.exe 1 14 2->8         started        signatures3 process4 signatures5 44 Query firmware table information (likely to detect VMs) 8->44 46 Tries to detect sandboxes and other dynamic analysis tools (window names) 8->46 48 Tries to harvest and steal browser information (history, passwords, etc) 8->48 50 2 other signatures 8->50 11 cmd.exe 2 8->11         started        14 cmd.exe 2 8->14         started        16 cmd.exe 2 8->16         started        18 4 other processes 8->18 process6 signatures7 52 Tries to harvest and steal browser information (history, passwords, etc) 11->52 20 conhost.exe 11->20         started        22 conhost.exe 14->22         started        24 conhost.exe 16->24         started        26 conhost.exe 18->26         started        28 conhost.exe 18->28         started        30 conhost.exe 18->30         started        32 conhost.exe 18->32         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f8462784c938c32e326abdba379d8944c9600f34ad85737efd6e7866d0bedff8/
Threat name:
Win32.Packed.Themida
Create hunting rule
Status:
Malicious
First seen:
2022-03-11 19:33:18 UTC
File Type:
PE (Exe)
Extracted files:
13
AV detection:
23 of 27 (85.19%)
Threat level:
  1/5
Verdict:
malicious
Similar samples:
1ea344df676e38129a21b994a29ba66cc814348ae6bb99bd068b4c5cc51e27b0
3a1b706adecf798ffa11002e153bad33e9f82e6a9da82f7777c27d2cf7b23b0d
7ebd75f04be7424a2c2faa8be74538af662198fcd6c88bbeb4c99df4991ac06d
820b1216485962fa3501dc8bd02a76bdb821fd7b6ffab858c4ebe135c4246090
8b47208af9a6ddc6cbba36c03495fb4308c64b18bd455925502c9e39326e693e
c3096cfa6809f117e6d9d1011c57a91ab81055d92ff3348c51c47ceed7e330bc
c5235a63f916e2de15aaa66e0664c1548caa85c4a56c11fb5e328921bab1f459
ce931ede894759cdd518d9dd8f4a9888b7fa3656bd6fa3bc0b66514b985efb5d
fcccde6b56dbe8650273f1d67957a1adc1dd0e783d43d6543da7a44696731292
fda35cece63310cf205317722754efa6773e9faa0b787dcc7dadf46a7da10383
+ 9'904 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
discovery evasion spyware stealer themida trojan
Link:
https://tria.ge/reports/220311-x9h3ssahh6/
Behaviour
Checks processor information in registry
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
AutoIT Executable
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Reads user/profile data of web browsers
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
493cc2e81c3ac647a48f616461250eac4b86df86d405d24426e02ff1053689b8
MD5 hash:
505ba20585f21719a288009895999edc
SHA1 hash:
4b7f42c176ccea96f1745b7d03791426833ec2b8
Link:
https://www.unpac.me/results/10a06b80-4ca0-4621-8d1c-01e45f9c4d5a/
SH256 hash:
f8462784c938c32e326abdba379d8944c9600f34ad85737efd6e7866d0bedff8
MD5 hash:
1ba42ca00e1c4c79dda860c5c24ede8c
SHA1 hash:
ecf7affe7a1d34182f3e44ca8d1f7a49595f81dc
Link:
https://www.unpac.me/results/10a06b80-4ca0-4621-8d1c-01e45f9c4d5a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f8462784c938/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/f8462784c938c32e326abdba379d8944c9600f34ad85737efd6e7866d0bedff8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).
Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe f8462784c938c32e326abdba379d8944c9600f34ad85737efd6e7866d0bedff8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2086285/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/249686/

Comments