MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c460b12b1f4594cb2bb7d67c117cb694614aba1c18abfa1041c76ef47eec44c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c460b12b1f4594cb2bb7d67c117cb694614aba1c18abfa1041c76ef47eec44c
SHA3-384 hash: 637c3eac45eb38d437113f8cee480161fb5b109089dc2ee9beb87642a4993045dffd413f9dc09b36324bce919daaf9b4
SHA1 hash: 1e9faf165f35534cbca5cfbbaafbaff0e2e6bc26
MD5 hash: cb8b1fabf84d75e7872bc96468385936
humanhash: fifteen-island-august-nuts
File name:64a866fc24b07926fcc74b2a72caeec2
Download: download sample
File size:1'163'700 bytes
First seen:2020-11-17 11:48:50 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 811acb86d267b150210d316e8990712d
ssdeep 24576:3fBTSAYlbu/9gj467Ur7iNxNZJudt0EU+pnKFYBtj6j+opznF/bJ:bgu/9G467Ur7wNidtVTpnKFYBV6j+AzX
TLSH EE35BE42EBC9C171CE8F42F448B5536E4A375E0993B196C3FB8E3B5A4E311E0B939256
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
49
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Virus.Ramnit-9775603-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Searching for the window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c460b12b1f4594cb2bb7d67c117cb694614aba1c18abfa1041c76ef47eec44c/
Threat name:
Win32.Worm.Ramnit
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 11:52:23 UTC
AV detection:
33 of 48 (68.75%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence upx
Link:
https://tria.ge/reports/201117-qg536zbdr6/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Modifies service
Loads dropped DLL
Executes dropped EXE
UPX packed file
Unpacked files
SH256 hash:
4c460b12b1f4594cb2bb7d67c117cb694614aba1c18abfa1041c76ef47eec44c
MD5 hash:
cb8b1fabf84d75e7872bc96468385936
SHA1 hash:
1e9faf165f35534cbca5cfbbaafbaff0e2e6bc26
Link:
https://www.unpac.me/results/4e94ee57-f14c-45e9-8ff4-7b50ab31d525/
SH256 hash:
5e805780f4e840580c60a8925a129e78b6b4bcf2a64cc12287c9f2f0ce25c4a4
MD5 hash:
9e57e3a559908c2445d40496210707da
SHA1 hash:
4b6db64c6e560665f13f3974457a880c53a6174e
Detections:
win_ramnit_g0
Create hunting rule
win_ramnit_g1
Create hunting rule
win_ramnit_auto
Create hunting rule
Link:
https://www.unpac.me/results/4e94ee57-f14c-45e9-8ff4-7b50ab31d525/
Parent samples :
4c460b12b1f4594cb2bb7d67c117cb694614aba1c18abfa1041c76ef47eec44c
9edbdfe197acf70216e52d558ff3c076be7b71c67beaa56f0fe06ef769db144e
f1da2af4d03374487f047533fcf04795dab48c3b862342c0219bab3e5dbb52c4
9303baf8bfa696731486273de443d5424dbe71c01fb856aa31cd778bbd4753b4
a0adbb57264ffd5b728b19b8217ae80ba073a0a440978dde87466ba81ef668de
SH256 hash:
985f1f17203a632b8fb2093278b42e3de3f9a7df1409431b7010df765675198a
MD5 hash:
0f1114d69d2541d8a3e9f9263a0b7e54
SHA1 hash:
8e310de4cb97eaa9395829b816d8968d3a1df9f8
Detections:
win_ramnit_g0
Create hunting rule
win_ramnit_g1
Create hunting rule
win_ramnit_auto
Create hunting rule
Link:
https://www.unpac.me/results/4e94ee57-f14c-45e9-8ff4-7b50ab31d525/
Parent samples :
4c460b12b1f4594cb2bb7d67c117cb694614aba1c18abfa1041c76ef47eec44c
9edbdfe197acf70216e52d558ff3c076be7b71c67beaa56f0fe06ef769db144e
f1da2af4d03374487f047533fcf04795dab48c3b862342c0219bab3e5dbb52c4
9303baf8bfa696731486273de443d5424dbe71c01fb856aa31cd778bbd4753b4
a0adbb57264ffd5b728b19b8217ae80ba073a0a440978dde87466ba81ef668de
SH256 hash:
886eb91e7c1b54ce9b33828b94564a3fa500db94ff24e37719885ec9590db772
MD5 hash:
76668e69b4d35de8372a00f0359ee83b
SHA1 hash:
d10e1e6a572e1efb36c2e86b40f324e88c16c017
Link:
https://www.unpac.me/results/4e94ee57-f14c-45e9-8ff4-7b50ab31d525/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments