MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81ac71909750b1ba2225c173ea99f56d6e237aeb70b45212ac757e265c25ea6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81ac71909750b1ba2225c173ea99f56d6e237aeb70b45212ac757e265c25ea6f
SHA3-384 hash: 387bf1a5ad557615a584390efc0e812760e0068594fa65165c7a345f5a785a59679a76665e42d02d8e1efd4a41f8c2e2
SHA1 hash: 616a611d59cc5d443991303e26136e0a44926ff5
MD5 hash: 6ac5e900c2c60346ba401e014345d7f8
humanhash: ack-hot-hamper-louisiana
File name:DEEM Nuker.exe
Download: download sample
File size:8'810'872 bytes
First seen:2021-10-22 00:14:32 UTC
Last seen:2021-10-22 01:16:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2cdcfb3a828433ba76b5b41f45519bd9 (2 x ROKRAT, 1 x IcedID)
ssdeep 196608:ySHx7ww7ICteEroXxsfVfEqlbkkwR7VTEJZ3OcmjQ9/DLDxbDw64g:1LInEroXafEqirRRoJZ3On+/DLlj
Threatray 27 similar samples on MalwareBazaar
TLSH T120963319A3840CDDE0F60130A6708535E13BFC724344D5572BAC9A67AFB36E9ADB6F90
File icon (PE):PE icon
dhash icon 68ccccf4d4696030
Reporter JaffaCakes118
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DEEM Nuker.exe
Verdict:
No threats detected
Analysis date:
2021-10-22 00:14:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8073bf0a-3168-421a-864a-956228e24509

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
PyInstaller
Create hunting rule
Link:
https://www.capesandbox.com/analysis/199227/
Detection(s):
SecuriteInfo.com.PyInstaller.8642.24607.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Deleting a recently created file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cridex greyware overlay packed python
Link:
https://www.filescan.io/uploads/61720289db358dd15ed0f655/reports/5de94568-73d9-4adc-b0f3-c355bea8d370/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
GetYourFilesBack Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a18e155c-5342-4660-9ff9-791af3d9c95e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/874950
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 507378 Sample: DEEM Nuker.exe Startdate: 22/10/2021 Architecture: WINDOWS Score: 48 24 Multi AV Scanner detection for submitted file 2->24 7 DEEM Nuker.exe 42 2->7         started        process3 file4 16 C:\Users\...\_quoting_c.cp39-win_amd64.pyd, PE32+ 7->16 dropped 18 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 7->18 dropped 20 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 7->20 dropped 22 28 other files (none is malicious) 7->22 dropped 10 DEEM Nuker.exe 1 7->10         started        12 conhost.exe 7->12         started        process5 process6 14 cmd.exe 1 10->14         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/81ac71909750b1ba2225c173ea99f56d6e237aeb70b45212ac757e265c25ea6f/
Threat name:
Win64.Worm.Cridex
Create hunting rule
Status:
Malicious
First seen:
2021-10-22 00:15:10 UTC
AV detection:
3 of 28 (10.71%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
053e7603d2776f39c17d74cd5a095d2fa4727ce019cb91274c135be4b9732358
089b3975338c69d1c8ae96cec13328459e8208c7cf9c88ce98896b90697c140b
16a9bd04b1d92c0853acb7a0e7e9d3a047e9a55829245be9aa23b5088a072f4a
314f7cd6f05ec806c204001478d0498bcaed44acb7648f4961faabef6562fe47
3f09f8df1e94e9588e4f9584e4d97eae73bf6e7375c92751cbb1f7e9647242d3
622fb838298b78969dfbe0d1ff0c2fcea071b77e9a30332805a532683a039570
684aa3d044556d1883bed06b737a297eac301d14872e1813b0e5cd78cefaa95d
774c3c82a6ba75819070cca4d14f0df9329ebfe5b4dbb2e61423f95281ae7e6d
da23dacc9e28905b0cc9f0724e182e8963525162b177d023c0c859e8fee09d43
fd81b3ed300db65a7a31b2b10011c9bfa9a2349571e2ccb532bc714856241b8e
+ 17 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/211022-ajxryabaa3/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Unpacked files
SH256 hash:
81ac71909750b1ba2225c173ea99f56d6e237aeb70b45212ac757e265c25ea6f
MD5 hash:
6ac5e900c2c60346ba401e014345d7f8
SHA1 hash:
616a611d59cc5d443991303e26136e0a44926ff5
Link:
https://www.unpac.me/results/68bb06f1-e27b-4e86-a4d1-8617a45f205c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/81ac71909750b1ba2225c173ea99f56d6e237aeb70b45212ac757e265c25ea6f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 81ac71909750b1ba2225c173ea99f56d6e237aeb70b45212ac757e265c25ea6f

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/199227/

Comments