MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03745fbf91cf67f1c079704524ed1b5064fc3e067083e33a9cc1655a3748ee2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments 1

SHA256 hash:	03745fbf91cf67f1c079704524ed1b5064fc3e067083e33a9cc1655a3748ee2a
SHA3-384 hash:	fbde7dae38e9efc0c70f8e2da5c1d0eeb9a5ccc2c3967fc6c5d78ecf6f7fdb7211159c4dbe82a76b30eb149b1b769bc1
SHA1 hash:	f63de1f674ba6b467adf4e5dc74409e8780c9a1d
MD5 hash:	7c986ab5d46078154d0d302dc5360f62
humanhash:	hotel-autumn-mike-tango
File name:	7c986ab5_by_Libranalysis
Download:	download sample
File size:	996'622 bytes
First seen:	2021-05-05 08:07:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	26496ab6355e75472c49cf2dc4f6cc6c
ssdeep	12288:M8kxNhOZElO5kkWjhD4AyE8kxNhOZElO5kkWjhD4Ay:jqEkfFQqEkfF
TLSH	A1257D2AF7C08837D2631A38CD5B9768AC26BE503E2955463BF81D4C5F79381392A3D6
Reporter	Libranalysis

Libranalysis

Uploaded as part of the sample sharing project

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/150042/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file

Creating a service

Enabling the 'hidden' option for recently created files

Creating a process from a recently created file

Creating a process with a hidden window

Searching for the window

Enabling autorun for a service

Enabling autorun with the shell\open\command registry branches

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/03745fbf91cf67f1c079704524ed1b5064fc3e067083e33a9cc1655a3748ee2a/

Threat name:

Win32.Worm.Fasong

Status:

Malicious

First seen:

2020-05-06 23:42:14 UTC

AV detection:

47 of 48 (97.92%)

Threat level:

5/5

Verdict:

suspicious

Result

Malware family:

n/a

Score:

10/10

Tags:

persistence upx

Link:

https://tria.ge/reports/210505-kdc3f516ee/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Adds Run key to start application

Enumerates connected drives

Loads dropped DLL

Executes dropped EXE

UPX packed file

Modifies system executable filetype association

Unpacked files

SH256 hash:

03745fbf91cf67f1c079704524ed1b5064fc3e067083e33a9cc1655a3748ee2a

MD5 hash:

7c986ab5d46078154d0d302dc5360f62

SHA1 hash:

f63de1f674ba6b467adf4e5dc74409e8780c9a1d

Link:

https://www.unpac.me/results/628650fe-4a5a-49d6-9c0e-fe67e757d160/

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/150042/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-05 09:23:48 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
2) [F0001.008] Anti-Behavioral Analysis::UPX
3) [F0002.002] Collection::Polling
5) [C0021] Cryptography Micro-objective::Generate Pseudo-random Sequence
6) [C0019] Data Micro-objective::Check String
7) [C0026.001] Data Micro-objective::Base64::Encode Data
8) [C0026.002] Data Micro-objective::XOR::Encode Data
12) [B0023] Execution::Install Additional Program
13) [C0047] File System Micro-objective::Delete File
14) [C0050] File System Micro-objective::Set File Attributes
15) [C0007] Memory Micro-objective::Allocate Memory
16) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
17) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
18) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
19) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
20) [C0043] Process Micro-objective::Check Mutex
21) [C0042] Process Micro-objective::Create Mutex
22) [C0017] Process Micro-objective::Create Process
23) [C0038] Process Micro-objective::Create Thread
24) [C0054] Process Micro-objective::Resume Thread
25) [C0041] Process Micro-objective::Set Thread Local Storage Value
26) [C0018] Process Micro-objective::Terminate Process