MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46552aa0ea1419bb208ac1d67ae7c39e1573aabc82080fdff968a0c1867d0a22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46552aa0ea1419bb208ac1d67ae7c39e1573aabc82080fdff968a0c1867d0a22
SHA3-384 hash: 502bfa3c53f6d2856e0f981c738bd5493c2a85f0ee12d90bff5a8941e2c84cad6382ee69a97ed758fdfe115c2f52996c
SHA1 hash: 31682be5478deee1ea8fe2a8a34e28967197e132
MD5 hash: 1708c765ec98377bf44906012df334a0
humanhash: sierra-louisiana-colorado-cat
File name:malware_with_signature_Accelerate Technologies Ltd (37)
Download: download sample
File size:1'050'144 bytes
First seen:2020-08-29 08:21:01 UTC
Last seen:2020-08-29 08:36:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 85feb9fdb86a77893420ff3a262a40b7
ssdeep 12288:gVd11fheE9zHDefVEmRnG2BaVfqMVfV2wNUGUJdf+xnxsxPxQymAXVq:gbVHDefVEenG2afqMVfV26UGUJdfG4q
Threatray 7 similar samples on MalwareBazaar
TLSH D9252A7DE70625F4EA2762B2819EEB775B18BA158032AE7FFF4FC604B0335162C450A5
Reporter JAMESWT_WT
Tags:Accelerate Technologies Ltd

Code Signing Certificate

Organisation:Accelerate Technologies Ltd
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:Mar 7 00:00:00 2020 GMT
Valid to:Mar 4 23:59:59 2021 GMT
Serial number: B3F906E5E6B2CF61C5E51BE79B4E8777
Intelligence: 35 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 2B48363D587B11F2726D343E0ED1D76A2E4ADBC4A383C30CDAE41ADE0006B224
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/52837/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Spy.18178.22618.10900.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Enabling autorun
DNS request
Sending a UDP request
Unauthorized injection to a recently created process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/454210
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to inject code into remote processes
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46552aa0ea1419bb208ac1d67ae7c39e1573aabc82080fdff968a0c1867d0a22/
Threat name:
Win32.Dropper.NetTraveler
Create hunting rule
Status:
Malicious
First seen:
2020-08-24 21:37:39 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
22 of 29 (75.86%)
Threat level:
  3/5
Verdict:
unknown
Similar samples:
44979b3e2e49934c1b0a344711408cfe8d19c54c0c177cbc80425955b1d71b3d
a991f1aac4e086eaa96da23639f871b5629b4987a7a9203537a062075e8384e8
b70d7b1731c2e5af3847a1d54d746c376f676b3ca37bc8df31d0c1eba671ba79
c1d7731ac02354dce14bf98a56a00f0b908fa2d8dcb3375bee86fa3aca8d79f7
d0d8ca50b3046b2c5a6a992a4a4308e449e897446dcfefef9d0c4640538f9965
d69389d43f6a551acba49cb72681b92fe838725f116610a81f23ef25bb6f7f24
eab1c7370e4fe2a6b0798f4c9cb2cae10297acf31788a39bdcabe78c697d9336
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/200829-t4s2mhkbha/
Behaviour
Modifies Control Panel
Suspicious use of WriteProcessMemory
Modifies Control Panel
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Travnet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/46552aa0ea1419bb208ac1d67ae7c39e1573aabc82080fdff968a0c1867d0a22

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NetTraveler
Create hunting rule
Author:Katie Kleemola
Description:Nettravelr
Rule name:NetTravExports
Create hunting rule
Author:Katie Kleemola
Description:Export names for dll component
Rule name:NetTravStrings
Create hunting rule
Author:Katie Kleemola
Description:Identifiers for NetTraveler DLL
Rule name:win_nettraveler_w0
Create hunting rule
Author:Katie Kleemola
Description:Identifiers for NetTraveler DLL
Rule name:win_nettraveler_w2
Create hunting rule
Author:Katie Kleemola
Description:Export names for dll component

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/52837/

Comments