MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa91996407e821400f962f248c576cacc2163f61fa12b1f21d4ad6fede3a010e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mekotio

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments 1

SHA256 hash:	fa91996407e821400f962f248c576cacc2163f61fa12b1f21d4ad6fede3a010e
SHA3-384 hash:	b82b5421e02a698dbbf57f94c1cf569c48e6b1f913fe0b6c2cd1bb87d131d9a5dc938322239a5e6965827057e8a3bf34
SHA1 hash:	69f3fd76e701dac25915edffd193cde1ebb415e1
MD5 hash:	08a0ae7049ed6a6cf5d93ef1e22db569
humanhash:	blue-michigan-carolina-mountain
File name:	Multa.1650991617.msi
Download:	download sample
Signature	Mekotio Create hunting rule
File size:	3'406'848 bytes
First seen:	2022-04-27 09:39:27 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	98304:GtMKAptulbxKO1fTCcOjSEPYLDu5+tK3HyfYM:GLxfTCcKUDu5w+HUY
Threatray	976 similar samples on MalwareBazaar
TLSH	T133F5CF26759BC636EA7E8270652DCB7A60B97FF00BB244EB63C4592E0D744C10272F67
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter	dgsecnet
Tags:	Mekotio msi

dgsecnet

hxxp://20.235.17[.]5/

Intelligence

File Origin

# of uploads :

# of downloads :

272

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/267197/

Detection(s):

SecuriteInfo.com.AutoIT_Compiled.11820.19429.UNOFFICIAL

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

80%

Tags:

anti-vm control.exe evasive fingerprint remote.exe shell32.dll

Link:

https://www.filescan.io/uploads/62690f752b32b1c37c64dded/reports/10e8e156-b8ba-4026-afdc-faebfbc20905/overview

Result

Verdict:

SUSPICIOUS

Link:

https://labs.inquest.net/dfi/sha256/fa91996407e821400f962f248c576cacc2163f61fa12b1f21d4ad6fede3a010e

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.evad

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/983955

Signature

May check the online IP address of the machine

Sample or dropped binary is a compiled AutoHotkey binary

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fa91996407e821400f962f248c576cacc2163f61fa12b1f21d4ad6fede3a010e/

Threat name:

Win32.Trojan.Mekotio

Status:

Suspicious

First seen:

2022-04-26 21:48:01 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

6 of 40 (15.00%)

Threat level:

5/5

Verdict:

unknown

Mekotio

29d5119f820b68d9e231a4812290395628313ff03a4c04b72190a7fb39b260c4

Mekotio

6cb693b434ef3c9155fd802d07ef6e3d77fb2ca90435d89fa945ddf525170a0a

Mekotio

94a3555c14771a4b3a7078f878e7530e04dcc846570b30f29aeb67c6733065d6

Mekotio

ba7753740ad8417eefd87b7ca66888ac93184752769db47b467d47687a132597

Mekotio

cfa9c1d8b0ea8b947b89c01c9cbb87a70161a528337e5af00e855a70d350f22e

Mekotio

d95edec180d7c2ea69585c2e2fe6f7d30421fe0974b38afdc88a4ba756514cd6

Mekotio

fdbf873a5b98ba84b1e2d4b32b161360e25fdab595514666933bbb51f2f89a02

Mekotio

+ 966 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/220427-lm7bbsahf2/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Drops file in Windows directory

Enumerates connected drives

Looks up external IP address via web service

Loads dropped DLL

Executes dropped EXE

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fa91996407e8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mekotio

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/fa91996407e821400f962f248c576cacc2163f61fa12b1f21d4ad6fede3a010e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.