MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbdc74e4a2733561fa077873a008e9aba4cf1415af1c6aaea2d8cb3ab435ddad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fbdc74e4a2733561fa077873a008e9aba4cf1415af1c6aaea2d8cb3ab435ddad
SHA3-384 hash:	a60e0c74d98c96272c2c239ed5788ea782da2facb457a3432c8f2f117ccd71c0d6a569ff1816da2ca0f80e8c7ba03a13
SHA1 hash:	c459315c5a7c4e014867d8e27b1209c6de7f2fa2
MD5 hash:	ceb4847592b0b9ddc2b9c239fa48c471
humanhash:	delta-burger-butter-lion
File name:	Statement of undeclared funds (Enforcement Rules of the Value Added Tax Act).hwp.lnk
Download:	download sample
File size:	70'097'157 bytes
First seen:	2023-12-14 00:54:48 UTC
Last seen:	Never
File type:	lnk
MIME type:	application/octet-stream
ssdeep	3072:6I0dUkYRw0Oz+EQpmj3GGuP6MMbYEXLL3Tg80csCWv:dHRdOz+EQpG3GNP6ZLLjYj
TLSH	T181E7CE54B3E82504F5B21B340BFC25350B6B781A2831EDBF142C41E98BEBD86B964B76
Reporter	smica83
Tags:	apt APT37 lnk

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

327

Origin country :

HU

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

masquerade powershell

Link:

https://www.filescan.io/uploads/657a5269da3178d99ce42d43/reports/3c94e9d1-2187-466c-b886-4d25de621977/overview

Hybrid Analysis Trojan.Multi.Powenot

Verdict:

Malicious

Labled as:

Trojan.Multi.Powenot

Link:

https://www.hybrid-analysis.com/sample/fbdc74e4a2733561fa077873a008e9aba4cf1415af1c6aaea2d8cb3ab435ddad

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1361831

Signature

Antivirus detection for URL or domain

Creates autostart registry keys with suspicious values (likely registry only malware)

Creates processes via WMI

Deletes itself after installation

Encrypted powershell cmdline option found

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Obfuscated command line found

Powershell creates an autostart link

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic

Suspicious powershell command line found

Uses cmd line tools excessively to alter registry or file data

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Obfuscated Powershell

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Shortcut.Trojan.Generic

Threat name:

Shortcut.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-12-13 11:03:57 UTC

File Type:

Binary

AV detection:

6 of 37 (16.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7pohjzfcom2wd6qhpbz2achjvosm6favv4ogvlvc3dftvnbv3wwq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

persistence

Link:

https://tria.ge/reports/231214-a9s7faadgn/

Behaviour

Delays execution with timeout.exe

Gathers system information

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Windows directory

Adds Run key to start application

Checks computer location settings

Deletes itself

Executes dropped EXE

Blocklisted process makes network request

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://aufildeseaux.com/wp-admin/includes/main/read/get.php?pw=xlse&cm=ns0010
http://ddsdata.net/upload.php
http://ddsdata.net/list.php?f=URUOZWGF.txt
http://ddsdata.net/list.php?f=OEJHVKBK.txt

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.