MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 facb6240627523db6b3ea21e1acefdc1183ae7f4496fd333227ac764a5ab2c21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PoshC2


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: facb6240627523db6b3ea21e1acefdc1183ae7f4496fd333227ac764a5ab2c21
SHA3-384 hash: f11aea5bc2e9536be5930e2dffb9532c0918c36b40b26bc2d1f4f4f746d3d91d0c1cad4a8f4e2c906139ef62b1fd4ac4
SHA1 hash: b2c1a8c3fc1a68633b1ec64c48a25e8f7de3e598
MD5 hash: 364f1eeb1ecba221d1ba930fbdb5e050
humanhash: yankee-alabama-winter-wisconsin
File name:SecuriteInfo.com.Trojan.RunPowerShellNET.8.21087.27712
Download: download sample
Signature PoshC2
Create hunting rule
File size:140'288 bytes
First seen:2023-12-04 22:30:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bb9dc484d891a7cf70c5c51b76b5d7db (7 x PoshC2)
ssdeep 3072:GrKiddDSt4dtH1G2hfdE1DecSTs377PhrU:AKiddDIK7GiO0v27jhrU
Threatray 10 similar samples on MalwareBazaar
TLSH T14DD36D7E35B16806F6ED0B74F0F8AA5342003123BDE64CDE2D14DA2CD3339A7769A665
TrID 40.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
12.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.0% (.EXE) Win32 Executable (generic) (4505/5/1)
5.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:exe poshc2

Intelligence

File Origin
# of uploads :
1
# of downloads :
316
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/462470/
Detection(s):
SecuriteInfo.com.Trojan.RunPowerShellNET.8.21087.27712.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug packed
Link:
https://www.filescan.io/uploads/656e5360da3178d99cd7751d/reports/1aaaae56-9d41-4c86-aa73-06b02a5e5c7f/overview
Verdict:
Malicious
Labled as:
DeepScan:Generic.ShellCode.RDI.Marte.4
Link:
https://www.hybrid-analysis.com/sample/facb6240627523db6b3ea21e1acefdc1183ae7f4496fd333227ac764a5ab2c21
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ccfecdb5-25ab-49f1-805d-b9a852e44b30
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1353554
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to inject threads in other processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/facb6240627523db6b3ea21e1acefdc1183ae7f4496fd333227ac764a5ab2c21/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-12-04 22:32:08 UTC
File Type:
PE (Exe)
AV detection:
19 of 23 (82.61%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7lfweqdcour5w2z6uipbvtx5yemdvz7ujfx5gmzcpldwjjnlfqqq._file
Verdict:
malicious
Similar samples:
757bfe7baa14a89de806a73437b3aec27d8ae6638a0de45e6a81b4d4ad8f3c1c
PoshC2
7c3ac84e096ca5f2bbb36520dac302bfa00b6cd61598eafbffeaabea66bfa307
PoshC2
7c3f8d84b7cb379acf14a5395862b51f94936b5db1e4f34e8e3c8f39c4350192
PoshC2
a6c2b68b46b6b478ae984fd861f1681688a64c2f1f3227256e6fd436be1569e0
PoshC2
f8edb214d9bdf554245d8ec7745ab9a33a520e77d1ca30897feb8388a492315a
PoshC2
facb6240627523db6b3ea21e1acefdc1183ae7f4496fd333227ac764a5ab2c21
PoshC2
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/231204-2fekqsfh8w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
7c71cdf31a4ec57919e8df00d35679556e36d001417d5753a1a44e3b14e5f9aa
MD5 hash:
c31045954d6264b6c27ca1d1c2de6cab
SHA1 hash:
c19d7c8a407cea0bcaca559d1476c6c627f5881c
Link:
https://www.unpac.me/results/8e3faae6-03f7-4aa5-9bd8-d97cfb8a9ebf/
SH256 hash:
adbe6be69526272f077c4df3f797759f5b3dfe2c23f9d593a84618ecf2c90e0d
MD5 hash:
17ec2f2f75bac46106a6ac07d909eb66
SHA1 hash:
456cbbc55e1d45e29d946887bacb1fcaea0a2a16
Detections:
Gen_Base64_EXE
Create hunting rule
Link:
https://www.unpac.me/results/8e3faae6-03f7-4aa5-9bd8-d97cfb8a9ebf/
SH256 hash:
facb6240627523db6b3ea21e1acefdc1183ae7f4496fd333227ac764a5ab2c21
MD5 hash:
364f1eeb1ecba221d1ba930fbdb5e050
SHA1 hash:
b2c1a8c3fc1a68633b1ec64c48a25e8f7de3e598
Link:
https://www.unpac.me/results/8e3faae6-03f7-4aa5-9bd8-d97cfb8a9ebf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/facb6240627523db6b3ea21e1acefdc1183ae7f4496fd333227ac764a5ab2c21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:Windows_Shellcode_Rdi_eee75d2c
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PoshC2

Executable exe facb6240627523db6b3ea21e1acefdc1183ae7f4496fd333227ac764a5ab2c21

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2737386/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/462470/

Comments