MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9017da9bf07e1821c95ffabafb0ca8c36ffe3af3cd8a80ec3c9d6060b8d49df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9017da9bf07e1821c95ffabafb0ca8c36ffe3af3cd8a80ec3c9d6060b8d49df
SHA3-384 hash: 3626c7a7e460ff6fc0e46586fd5f2f61d58beb8890d749acaa7c83e9d5affcf313b01443f60fbff0bc7fd8cb23dd216f
SHA1 hash: 7a1fc3b84c1d431ef10e9d0b5f398a8e8b7fef3c
MD5 hash: af97ea12970796db02d8755905cc56a0
humanhash: winter-mars-sink-skylark
File name:delt.hta
Download: download sample
File size:354'297 bytes
First seen:2024-09-02 19:38:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f80bc97436232f135d9706a88c8c960e (1 x Emmenhtal)
ssdeep 6144:0VYIbMos9I7CVYIbMos9I70lP0Uf7eJNHgVYIbMos9I75VYIbMos9I7:0VYIoos9I7CVYIoos9I7cVYIoos9I75d
TLSH T18D745D02A2C368D9D3B38D3E10BA271915E58C3D9F0355AFE1902F978C155B39C6B7AB
TrID 51.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.2% (.EXE) Win64 Executable (generic) (10523/12/4)
10.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.3% (.EXE) Win32 Executable (generic) (4504/4/1)
3.3% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
File icon (PE):PE icon
dhash icon f8697868b2f069d4 (5 x DarkVisionRAT, 1 x Worm.Virut, 1 x Emmenhtal)
Reporter aachum
Tags:hta IDATDropper


Avatar
iamaachum
https://getyourpages.com/downloads/delt

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
delt
Verdict:
No threats detected
Analysis date:
2024-09-02 01:47:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6438d0a5-bd26-4c97-b9a7-69d9b80625dd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Riskware.00584baa1.15632.10184.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66d6141e8e12b8124ac9027d
Tags:
Encryption Static Malware
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto epmicrosoft_visual_cc fingerprint masquerade microsoft_visual_cc overlay stealer
Link:
https://www.filescan.io/uploads/66d64a3330f4e9458c21a229/reports/acbc2626-f1c9-40b5-adfb-bc16416f171b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/f9017da9bf07e1821c95ffabafb0ca8c36ffe3af3cd8a80ec3c9d6060b8d49df
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
MustardSandwich
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/60ba6e04-f177-4479-8a63-d71d01c60166
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1503066
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1503066 Sample: delt.hta.exe Startdate: 02/09/2024 Architecture: WINDOWS Score: 48 13 Multi AV Scanner detection for submitted file 2->13 6 delt.hta.exe 1 2->6         started        process3 dnsIp4 11 1.1.1.1.in-addr.arpa 6->11 9 conhost.exe 6->9         started        process5
Score:
90%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f9017da9bf07e1821c95ffabafb0ca8c36ffe3af3cd8a80ec3c9d6060b8d49df
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f9017da9bf07e1821c95ffabafb0ca8c36ffe3af3cd8a80ec3c9d6060b8d49df/
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2024-09-01 19:20:34 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7eax3kn7a7qyehev76v27mgkrq3p7y5phtmkqdwdzhlamc4njhpq._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/240902-ycdbqawblm/
Behaviour
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c0981ae2-6a5f-4141-97bb-777afe6e7d33
Unpacked files
SH256 hash:
f9017da9bf07e1821c95ffabafb0ca8c36ffe3af3cd8a80ec3c9d6060b8d49df
MD5 hash:
af97ea12970796db02d8755905cc56a0
SHA1 hash:
7a1fc3b84c1d431ef10e9d0b5f398a8e8b7fef3c
Detections:
win_Emmenhtal_w0
Create hunting rule
Link:
https://www.unpac.me/results/6e76bcca-5dd3-46a4-a437-8d94879f2f6d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f9017da9bf07e1821c95ffabafb0ca8c36ffe3af3cd8a80ec3c9d6060b8d49df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_Malicious_VBScript_Base64
Create hunting rule
Author:daniyyell
Description:Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.
Rule name:EmmenHTAl
Create hunting rule
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LummaStealer

PowerShell (PS) ps1 0f5a83c355155e5b613060f2bf6ab9c20d80a1ffe787189ff788b4748b499ff5

Executable exe f9017da9bf07e1821c95ffabafb0ca8c36ffe3af3cd8a80ec3c9d6060b8d49df

(this sample)

  
Dropped by
SHA256 0f5a83c355155e5b613060f2bf6ab9c20d80a1ffe787189ff788b4748b499ff5
  
Dropping
LummaStealer
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3153565/
  
Dropped by
MD5 c6008e4112704d4b12edf494bd4117cd

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
DNS_APIPerforms DNS callsDNSAPI.dll::DnsQueryConfigAllocEx
KERNEL_APIManipulates Windows Kernel & Driversntdll.dll::RtlInitString
WIN_BASE_APIUses Win Base APIapi-ms-win-core-processthreads-l1-1-0.dll::TerminateProcess
WIN_CRYPT_APIUses Windows Crypt APICRYPT32.dll::CryptBinaryToStringA
WIN_SOCK_APIUses Network to send and receive dataWS2_32.dll::freeaddrinfo
WS2_32.dll::getaddrinfo

Comments