MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 561fe3832a5681034418efd005c0f2ebae8b9a54efa6d52761980fe6b3a31337. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 561fe3832a5681034418efd005c0f2ebae8b9a54efa6d52761980fe6b3a31337
SHA3-384 hash: 9e3f56fa9d14177ea5f506764caaaabe8ce38488fc97b7ddebe06d75601f1338f54f287d7e06dc26b4a346bced53c2c4
SHA1 hash: 63f3e5b93c9b8c1853755ecc04814cd91104837a
MD5 hash: 9a0be476b3b20d9de85bd48f5e20bff8
humanhash: sweet-salami-friend-ceiling
File name:561fe3832a5681034418efd005c0f2ebae8b9a54efa6d52761980fe6b3a31337
Download: download sample
File size:4'343'744 bytes
First seen:2020-09-01 09:17:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1deac0af3e6e6b3d3bdd06e9d477f731
ssdeep 49152:F6i8YG6po+T1zEGk1BHqhEqY5Oz6C7nyYobAqnOyLzEPgISt8/6A0R:F6i8Y9C1BHqhA6nUAkH4ID8/6ZR
Threatray 47 similar samples on MalwareBazaar
TLSH 7D169D11B7905025F9B316B949AFA168993DBAE11B28A0CB72DC1ECC5F35BE07C31397
Reporter JAMESWT_WT
Tags:Ample Digital Limited

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/53880/
Detection(s):
PUA.Win.Packer.Exe-6
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Trojan.Generic-6629273-0
Create hunting rule

PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Creating a process with a hidden window
DNS request
Creating a file in the Windows subdirectories
Deleting a recently created file
Creating a file in the drivers directory
Creating a service
Launching a service
Loading a system driver
Creating a file in the Windows directory
Sending an HTTP POST request
Sending an HTTP GET request
Creating a window
Deleting a system file
Enabling autorun for a service
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/456308
Signature
Antivirus / Scanner detection for submitted sample
Changes security center settings (notifications, updates, antivirus, firewall)
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Sample is not signed and drops a device driver
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 280538 Sample: 0s5p9oMk2O Startdate: 01/09/2020 Architecture: WINDOWS Score: 76 50 Antivirus / Scanner detection for submitted sample 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 NDIS Filter Driver detected (likely used to intercept and sniff network traffic) 2->54 56 Machine Learning detection for sample 2->56 7 0s5p9oMk2O.exe 5 2->7         started        12 svchost.exe 2->12         started        14 svchost.exe 1 1 2->14         started        16 8 other processes 2->16 process3 dnsIp4 42 c.75cs.com 7->42 44 b.75cs.com 7->44 48 2 other IPs or domains 7->48 34 C:\Windows\SysWOW64\drivers\qGLX7m.exe, PE32 7->34 dropped 36 C:\Windows\SysWOW64\driversbehaviorgraphmProtect.sys, PE32 7->36 dropped 38 C:\Windows\SysWOW64\...behaviorgraphmProtect-x64.sys, PE32+ 7->38 dropped 40 C:\Windows\SysWOW64\drivers\ProtectApi.dll, PE32 7->40 dropped 60 Drops executables to the windows directory (C:\Windows) and starts them 7->60 62 Sample is not signed and drops a device driver 7->62 18 qGLX7m.exe 2 7->18         started        22 cmd.exe 1 7->22         started        64 Changes security center settings (notifications, updates, antivirus, firewall) 12->64 24 MpCmdRun.exe 1 12->24         started        46 127.0.0.1 unknown unknown 14->46 file5 signatures6 process7 file8 32 C:\Windows\System32\drivers\5C985A98.sys, PE32+ 18->32 dropped 58 Sample is not signed and drops a device driver 18->58 26 conhost.exe 18->26         started        28 conhost.exe 22->28         started        30 conhost.exe 24->30         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/561fe3832a5681034418efd005c0f2ebae8b9a54efa6d52761980fe6b3a31337/
Threat name:
Win32.Trojan.Woool
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 20:16:00 UTC
File Type:
PE (Exe)
Extracted files:
102
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
025c02b41a8f743e5787b57e74631316db62317c41845402f3ad5e0575b6586e
0d47d1c6e21e6df01ac6593d252993b93a0a00a645e1687c2b75cd0b7656ec2b
123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e
16566bcc907929b1251cf158430a0e336cfd0269be8683d928f820a78703e53d
326767b296e7de3941d974bb9abde500b5b7cbefe4a080ab33e6a5b9a69c3070
4a46a253a8201ca8dd7be2be8ce8cdab7bd5cb5c39d7a87adaa03e96c3187be8
707330f0f7009aeb6cb1bba679ac72183ed938293fc5c2a4ecea035f245b789c
78d35a3dafd0617427465e820f9b337531df9ff263853e84a7d2e6cfb1a5faa6
c79f3e70d3993f9da3f7b010f8a1610ee52919191bb29e2359305b1b75f1a6b3
fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20
+ 37 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200901-pxxp7m1wen/
Behaviour
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies data under HKEY_USERS
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Loads dropped DLL
Loads dropped DLL
Drops file in Drivers directory
Executes dropped EXE
Drops file in Drivers directory
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/561fe3832a5681034418efd005c0f2ebae8b9a54efa6d52761980fe6b3a31337

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/53880/

Comments