MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fafa6b45c6684020d513319282c54e48547a56555c31ac7340a5c68dd1e56167. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fafa6b45c6684020d513319282c54e48547a56555c31ac7340a5c68dd1e56167
SHA3-384 hash: 3301bbcd4805da1fb3a1e167726744b575293f127b4e5929fb5ac3d8ba30e8846202e4d8df16a522614f5b204b542521
SHA1 hash: 98e5afbb3d4623266f5681be3560219931a071be
MD5 hash: c23e04416a7ff16b09ca718d19a1086f
humanhash: timing-ceiling-november-nineteen
File name:SecuriteInfo.com.Win64.PWSX-gen.19048.30929
Download: download sample
File size:273'920 bytes
First seen:2023-06-30 08:33:51 UTC
Last seen:2023-06-30 09:28:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:va1xyMdp43Af6AgaoY11H/3yrEvD9qE29eIP6JqPOEvD9qE29eIP6JqPmv6v3:va1TprmG3yrEZ4e1EZ4e4
Threatray 23 similar samples on MalwareBazaar
TLSH T12244D672755847CAE15A32F1E85650904AF22C2AC1C6CA4EA0F53E7F76B2703CD5ED2E
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
298
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win64.PWSX-gen.19048.30929
Verdict:
Malicious activity
Analysis date:
2023-06-30 08:36:58 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/447710f3-4c32-48fe-868e-57f64d5d2c97

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/403996/
Detection(s):
SecuriteInfo.com.Win64.PWSX-gen.19048.30929.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Creating a service
Launching a service
Loading a system driver
Creating a file in the Windows subdirectories
Creating a window
Creating a file in the Windows directory
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control lolbin
Link:
https://www.filescan.io/uploads/649e937acf99e7a5cfcc359d/reports/c52dff4e-4e02-4c4d-93f4-111cf7e7d444/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/fafa6b45c6684020d513319282c54e48547a56555c31ac7340a5c68dd1e56167
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/f8d18cee-20a2-4c6d-8487-7bc64058ee13
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1263743
Signature
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fafa6b45c6684020d513319282c54e48547a56555c31ac7340a5c68dd1e56167/
Threat name:
Win64.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2023-06-30 06:44:57 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
22
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7l5gwrognbacbvitggjifrkojbkhuvsvlqy2y42auxdi3upfmftq._file
Verdict:
malicious
Similar samples:
3956c21824bc18caca2523381ce3fa113e40d5e7f47bf2a05d65f2a1a27a3f1d
648278b0c127bfe2aa6668ad937735e2bbf55ab56fb0b4ef10ebbf9a824f60d9
66c869949719a64950f5aaf24a687b04bdc73d8690264cad8861716129f3c216
670bc9a86f72af2ab43a89c576a4e1874ce188b35a1f5656ea27f4b7ac3d5f09
754794ccb5c349adb0551759cc1cd6add14616a50b5b3ffe1b4c0d133d13f300
838ce5b36c1e435c66278140a5ba8c1468f5e844f8cd8dd4aa330c5640b56053
9b6573b930e72d319ef4efa0975ff1b59673f96633a03d5e338bc8d7418418f4
b82291de6b50625fbe64293024d4b7d3f1bc874e14d8a6c613b56cf4c5854d30
bfdc9430338ae8787f1ffd56e70d4805bf1a90538eac918e52a81e4001e379f5
+ 13 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/230630-kgetfsgf62/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Adds Run key to start application
Unpacked files
SH256 hash:
fafa6b45c6684020d513319282c54e48547a56555c31ac7340a5c68dd1e56167
MD5 hash:
c23e04416a7ff16b09ca718d19a1086f
SHA1 hash:
98e5afbb3d4623266f5681be3560219931a071be
Link:
https://www.unpac.me/results/27cab1c9-6245-441e-8b39-1f6b4efe61d7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fafa6b45c6684020d513319282c54e48547a56555c31ac7340a5c68dd1e56167

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/403996/

Comments