MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fee142712ee9fba0c3cc57b4e314480bf976e4b1707bbeb202a58ca2b98f39bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ManusCrypt


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fee142712ee9fba0c3cc57b4e314480bf976e4b1707bbeb202a58ca2b98f39bd
SHA3-384 hash: 1a860edaabd46f26728651420c971c408a083fec85f457d74704baebcee8da0347c489909809342e0e7ed09376ff672a
SHA1 hash: 8cc2b7ea3cc5f67e76ba7d705dc97c91f4f8cb1a
MD5 hash: 9939636c25206396c4919d90777f814d
humanhash: pizza-hamper-texas-eight
File name:file
Download: download sample
Signature ManusCrypt
Create hunting rule
File size:1'879'192 bytes
First seen:2023-01-23 03:57:52 UTC
Last seen:2023-01-23 14:15:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7976a9b1382e838e7c03a9427b5502e3 (1 x ManusCrypt, 1 x RedLineStealer)
ssdeep 49152:VeD4m8wmppTlh/hn8K7/DEdgcWkygLudab3zzG:VeEm8wmppTlhpnp/4degLfe
Threatray 330 similar samples on MalwareBazaar
TLSH T19395CEC5F932E811EF0A5E39D3429A71CA3AF760109E3382E3B7CB591E656D3BC05616
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 8e1361755159339e (1 x ManusCrypt)
Reporter andretavare5
Tags:exe ManusCrypt signed

Code Signing Certificate

Organisation:*.wordhippo.com
Issuer:Go Daddy Secure Certificate Authority - G2
Algorithm:sha256WithRSAEncryption
Valid from:2022-09-26T07:00:31Z
Valid to:2023-08-06T01:21:00Z
Serial number: 9c0b8c1cac6f8c43
Thumbprint Algorithm:SHA256
Thumbprint: 90847e9610e4758831d3473af5277803d2da8ca344dba2868eba111b9a9578f0
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from https://www.isurucabs.lk/SAM.exe

Intelligence

File Origin
# of uploads :
8
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-01-23 03:59:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/34557409-feba-4217-92b2-6def407b80a6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/355742/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Launching a process
Creating a file in the %temp% directory
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Detecting VM
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/62363/overview
Behaviour
MalwareBazaar
CheckScreenResolution
SystemUptime
CPUID_Instruction
MeasuringTime
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
greyware overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63ce05cc528134caf0431257/reports/bbca4e3b-6931-457e-9195-ab86833214ba/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b9d71a63-3eb7-454a-bfe7-807ef625c8f9
Result
Threat name:
RHADAMANTHYS, lgoogLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1156707
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Checks if the current machine is a virtual machine (disk enumeration)
Contain functionality to detect virtual machines
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to hide a thread from the debugger
Creates an undocumented autostart registry key
Detected unpacking (creates a PE file in dynamic memory)
Encrypted powershell cmdline option found
Found API chain indicative of sandbox detection
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Queues an APC in another process (thread injection)
Searches for specific processes (likely to inject)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected lgoogLoader
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 789439 Sample: file.exe Startdate: 23/01/2023 Architecture: WINDOWS Score: 100 72 Snort IDS alert for network traffic 2->72 74 Antivirus detection for URL or domain 2->74 76 Multi AV Scanner detection for dropped file 2->76 78 7 other signatures 2->78 11 file.exe 9 2->11         started        process3 dnsIp4 64 gt1aasf2jehvxqb17re.tlgkeh3lhfaxywosaqzaywwydblb3pr 11->64 56 C:\Users\user\AppData\Local\...\5933109.dll, PE32 11->56 dropped 104 Detected unpacking (creates a PE file in dynamic memory) 11->104 106 Found API chain indicative of sandbox detection 11->106 108 Writes to foreign memory regions 11->108 110 2 other signatures 11->110 16 fontview.exe 1 11->16         started        21 WerFault.exe 2 9 11->21         started        23 WerFault.exe 24 9 11->23         started        25 ngentask.exe 11->25         started        file5 signatures6 process7 dnsIp8 60 109.206.243.168, 49698, 49704, 49710 AWMLTNL Germany 16->60 48 C:\Users\user\AppData\...\nsis_uns5ae0a6.dll, PE32+ 16->48 dropped 80 Query firmware table information (likely to detect VMs) 16->80 82 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 16->82 84 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 16->84 86 9 other signatures 16->86 27 rundll32.exe 16->27         started        62 192.168.2.1 unknown unknown 21->62 50 C:\ProgramData\Microsoft\...\Report.wer, Unicode 21->50 dropped 52 C:\ProgramData\Microsoft\...\Report.wer, Unicode 23->52 dropped file9 signatures10 process11 signatures12 96 System process connects to network (likely due to code injection or exploit) 27->96 98 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 27->98 100 Tries to steal Mail credentials (via file / registry access) 27->100 102 4 other signatures 27->102 30 dllhost.exe 14 5 27->30         started        35 WerFault.exe 27->35         started        process13 dnsIp14 68 transfer.sh 144.76.136.153, 443, 49709 HETZNER-ASDE Germany 30->68 58 C:\Users\user\AppData\Local\...\Library.exe, PE32+ 30->58 dropped 70 System process connects to network (likely due to code injection or exploit) 30->70 37 Library.exe 1 6 30->37         started        file15 signatures16 process17 file18 54 C:\Users\user\AppData\Roaming\...\MSIBar.exe, PE32+ 37->54 dropped 88 Creates an undocumented autostart registry key 37->88 90 Machine Learning detection for dropped file 37->90 92 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 37->92 94 4 other signatures 37->94 41 powershell.exe 37->41         started        43 MSBuild.exe 37->43         started        signatures19 process20 dnsIp21 46 conhost.exe 41->46         started        66 45.159.189.105, 49716, 80 HOSTING-SOLUTIONSUS Netherlands 43->66 process22
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fee142712ee9fba0c3cc57b4e314480bf976e4b1707bbeb202a58ca2b98f39bd/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-01-23 03:58:09 UTC
File Type:
PE (Exe)
Extracted files:
27
AV detection:
11 of 26 (42.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=73que4jo5h52bq6mk62ogfcibp4xnzfrob535mqcuwgkfomphg6q._file
Verdict:
malicious
Similar samples:
2be47a55c0d9a863fb620ba88c0c276c2f97fa775eaa435c20d8065af267784e
ManusCrypt
9146cee3d387cb3d665885b95d885734541f281cbb2a4726b6a59df922a83ee7
ManusCrypt
a355fbce3b91a02a5b3e3af9a2b7b6fbaf9da6fdd5b2260e8e7c7b8ec1c1e2d2
ManusCrypt
b0a22e9a9850fa4356f5603905f45645489ae04d60d630772b3b8227a21b1956
ManusCrypt
ca871a9028d80e2b3d73a8fe07b9d1628b52e0f9163402a3ab3199f512a36ab1
ManusCrypt
ee8ea5570b0a2c9f6aef8e551cc0d3fbd0be45dc5c11c50ca7056eef2d85d77d
ManusCrypt
f92b81ca5eebd6f7fb97f0c94d92874c97d738db54887421b82cade3a4be90cd
ManusCrypt
fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595
ManusCrypt
+ 320 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:lgoogloader family:rhadamanthys downloader stealer
Link:
https://tria.ge/reports/230123-ejg4psbf58/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Loads dropped DLL
Detect rhadamanthys stealer shellcode
Detects LgoogLoader payload
LgoogLoader
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
c9ba489a1fcbc856c450a578029bd136b13355c4d0afdcabed47c6cf13186895
MD5 hash:
c8e0377ebec32a85f49e93924c26b9c8
SHA1 hash:
403a00d12c71383bf6022d53212eba4b342e748f
Link:
https://www.unpac.me/results/f1358c87-629c-4b46-9ee5-59328ed7cf48/
SH256 hash:
fee142712ee9fba0c3cc57b4e314480bf976e4b1707bbeb202a58ca2b98f39bd
MD5 hash:
9939636c25206396c4919d90777f814d
SHA1 hash:
8cc2b7ea3cc5f67e76ba7d705dc97c91f4f8cb1a
Link:
https://www.unpac.me/results/f1358c87-629c-4b46-9ee5-59328ed7cf48/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fee142712ee9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/fee142712ee9fba0c3cc57b4e314480bf976e4b1707bbeb202a58ca2b98f39bd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Chebka
Create hunting rule
Author:ditekSHen
Description:Detects Chebka
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Rule name:Windows_Trojan_Generic_a681f24a
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2509599/
Cape
Cape
https://www.capesandbox.com/analysis/355742/

Comments