MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fda13a311fc0f4d634b5eb46bff2e13b4fd67595f6db7be1e5e2e67dcf4a4bef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fda13a311fc0f4d634b5eb46bff2e13b4fd67595f6db7be1e5e2e67dcf4a4bef
SHA3-384 hash: f8837694b3e8b7846e5535544dde07faaf398acbf4c5715db340fe9de56fa78ef2b433ddffce10f576fc2565c7deb020
SHA1 hash: dc18982a87654dccdd4bc6eb2624b253c5263a5c
MD5 hash: 2cd7ff3b8ab2bf1cf6ee6de0a43a6c70
humanhash: oxygen-robin-solar-rugby
File name:2cd7ff3b8ab2bf1cf6ee6de0a43a6c70.exe
Download: download sample
File size:175'616 bytes
First seen:2023-01-15 14:32:31 UTC
Last seen:2023-01-15 16:37:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5b391a7df37e2fc8fb2cd7d845686c30
ssdeep 3072:wlkZeeYcbUCSdAbLhBSjcC+ON9VRGXSHd6VudYChZMyl9f:O+qVR8udSSf
TLSH T13704B2C872DA84F9C4620D39CDFABADC0769AF1005386B1F977C33790AB528C65A19D7
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2cd7ff3b8ab2bf1cf6ee6de0a43a6c70.exe
Verdict:
Malicious activity
Analysis date:
2023-01-15 14:34:53 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9106abe9-6ffe-46d0-8410-fb264e352a19

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/353126/
Detection(s):
SecuriteInfo.com.Variant.Doina.49262.2929.26520.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Launching a process
Downloading the file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/60468/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
No Threat
Threat level:
  2/10
Confidence:
80%
Tags:
greyware rat shell32.dll
Link:
https://www.filescan.io/uploads/63c40ea071fb096abeedafae/reports/4bfcda53-0894-4344-a685-3b4dacaf3cc8/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
lgoogLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e42ffa3e-9d9c-4545-be4a-67615b6ad98e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1151939
Signature
Antivirus detection for URL or domain
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Sigma detected: Powershell Download and Execute IEX
Uses ping.exe to check the status of other devices and networks
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 784670 Sample: QPcxp5Gp4y.exe Startdate: 15/01/2023 Architecture: WINDOWS Score: 84 37 Multi AV Scanner detection for domain / URL 2->37 39 Antivirus detection for URL or domain 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 2 other signatures 2->43 7 QPcxp5Gp4y.exe 13 2->7         started        process3 dnsIp4 33 conectiva.pe 144.217.158.133, 443, 49709, 49710 OVHFR Canada 7->33 35 www.conectiva.pe 7->35 45 Self deletion via cmd or bat file 7->45 11 cmd.exe 1 7->11         started        14 cmd.exe 1 7->14         started        signatures5 process6 signatures7 47 Uses ping.exe to check the status of other devices and networks 11->47 16 PING.EXE 1 11->16         started        19 conhost.exe 11->19         started        21 powershell.exe 14 16 14->21         started        23 conhost.exe 14->23         started        process8 dnsIp9 25 127.0.0.1 unknown unknown 16->25 27 www.conectiva.pe 21->27 29 conectiva.pe 21->29 31 62.233.57.95, 49719, 80 DivisionWRSBE unknown 21->31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fda13a311fc0f4d634b5eb46bff2e13b4fd67595f6db7be1e5e2e67dcf4a4bef/
Threat name:
Win32.Trojan.SelfDel
Create hunting rule
Status:
Malicious
First seen:
2023-01-14 17:55:54 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7wqtumi7yd2nmnfv5ndl74xbhnh5m5mv63nxxypf4lth3t2kjpxq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/230115-rwvlsabg8x/
Behaviour
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Deletes itself
Blocklisted process makes network request
Malware Config
Dropper Extraction:
https://www.conectiva.pe/doc/config_20.ps1
Unpacked files
SH256 hash:
fda13a311fc0f4d634b5eb46bff2e13b4fd67595f6db7be1e5e2e67dcf4a4bef
MD5 hash:
2cd7ff3b8ab2bf1cf6ee6de0a43a6c70
SHA1 hash:
dc18982a87654dccdd4bc6eb2624b253c5263a5c
Link:
https://www.unpac.me/results/8b7887d9-cab2-44d3-a34d-c232fbd2f3ec/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fda13a311fc0f4d634b5eb46bff2e13b4fd67595f6db7be1e5e2e67dcf4a4bef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe fda13a311fc0f4d634b5eb46bff2e13b4fd67595f6db7be1e5e2e67dcf4a4bef

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2502117/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/353126/

Comments