MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44979b3e2e49934c1b0a344711408cfe8d19c54c0c177cbc80425955b1d71b3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44979b3e2e49934c1b0a344711408cfe8d19c54c0c177cbc80425955b1d71b3d
SHA3-384 hash: e1f0f1db32315d841c7fd812f95ecd287671877b7840a267df1bafeae051a8dddc0997e513355728666170961570e190
SHA1 hash: ce59ae85adcc8fa3da3ec84ec971a0780f3188f9
MD5 hash: a76516f09d5419c54e984b49339b6077
humanhash: solar-failed-single-missouri
File name:malware_with_signature_Accelerate Technologies Ltd (2)
Download: download sample
File size:1'050'144 bytes
First seen:2020-08-29 08:15:02 UTC
Last seen:2020-08-29 08:36:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5019bfb36b3c11f85b37fed425ed0ce5
ssdeep 12288:06Kiq4BDAyzXeqEG9qRe9ax7UsrMqFfV7XOozVvVxnxMxvxMHZmq98nOj:0noXeqEG9ie9a+srMcfV7eozVvVHHIOj
Threatray 7 similar samples on MalwareBazaar
TLSH 5D252A7DE70665F4E62762B2819EEB7B5B18BA158032AE7FFF0FCA04B0335122C45195
Reporter JAMESWT_WT
Tags:Accelerate Technologies Ltd

Code Signing Certificate

Organisation:Accelerate Technologies Ltd
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:Mar 7 00:00:00 2020 GMT
Valid to:Mar 4 23:59:59 2021 GMT
Serial number: B3F906E5E6B2CF61C5E51BE79B4E8777
Intelligence: 35 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 2B48363D587B11F2726D343E0ED1D76A2E4ADBC4A383C30CDAE41ADE0006B224
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/52802/
Detection(s):
SecuriteInfo.com.BackDoor.Spy.3756.9086.23471.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Enabling autorun
DNS request
Sending a UDP request
Unauthorized injection to a recently created process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/454150
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to inject code into remote processes
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44979b3e2e49934c1b0a344711408cfe8d19c54c0c177cbc80425955b1d71b3d/
Threat name:
Win32.Dropper.NetTraveler
Create hunting rule
Status:
Malicious
First seen:
2020-08-24 23:49:06 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 29 (72.41%)
Threat level:
  3/5
Verdict:
unknown
Similar samples:
46552aa0ea1419bb208ac1d67ae7c39e1573aabc82080fdff968a0c1867d0a22
a991f1aac4e086eaa96da23639f871b5629b4987a7a9203537a062075e8384e8
b70d7b1731c2e5af3847a1d54d746c376f676b3ca37bc8df31d0c1eba671ba79
c1d7731ac02354dce14bf98a56a00f0b908fa2d8dcb3375bee86fa3aca8d79f7
d0d8ca50b3046b2c5a6a992a4a4308e449e897446dcfefef9d0c4640538f9965
d69389d43f6a551acba49cb72681b92fe838725f116610a81f23ef25bb6f7f24
eab1c7370e4fe2a6b0798f4c9cb2cae10297acf31788a39bdcabe78c697d9336
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/200829-9p84y8eqsa/
Behaviour
Modifies Control Panel
Suspicious use of WriteProcessMemory
Modifies Control Panel
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Travnet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/44979b3e2e49934c1b0a344711408cfe8d19c54c0c177cbc80425955b1d71b3d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NetTraveler
Create hunting rule
Author:Katie Kleemola
Description:Nettravelr
Rule name:NetTravExports
Create hunting rule
Author:Katie Kleemola
Description:Export names for dll component
Rule name:NetTravStrings
Create hunting rule
Author:Katie Kleemola
Description:Identifiers for NetTraveler DLL
Rule name:win_nettraveler_w0
Create hunting rule
Author:Katie Kleemola
Description:Identifiers for NetTraveler DLL
Rule name:win_nettraveler_w2
Create hunting rule
Author:Katie Kleemola
Description:Export names for dll component

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/52802/

Comments