MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b7e0a21e13f1607ef431f54a44902d9250a0d21420cc1618481bea5b1dee86a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b7e0a21e13f1607ef431f54a44902d9250a0d21420cc1618481bea5b1dee86a
SHA3-384 hash: 537c61f9494ecac9ebc00269004324b8bdace791062996430a4673095dbb3f35ef2e0086171c7d81234e4234b0302099
SHA1 hash: 9bd3d01e68d23beab8a6124296074e124938147e
MD5 hash: a70b749e1d8a236e343ddbdf9d19e7b8
humanhash: alabama-speaker-victor-whiskey
File name:a70b749e1d8a236e343ddbdf9d19e7b8
Download: download sample
File size:7'026'688 bytes
First seen:2021-02-27 16:57:26 UTC
Last seen:2021-02-27 19:00:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 960ef4de68dcace43ad03634f7e490cb (2 x Glupteba)
ssdeep 98304:yPSPy5cWS2rJ3lm/K05NY+AbutHT2GS16liKkpy:y2y5cWS0J3lmi05outHT9Vls
Threatray 22 similar samples on MalwareBazaar
TLSH 66667C03FCA914B9C6BEE23086619322FA71785543323BD35F94956A2667FE4BB3D310
Reporter c3rb3ru5d3d53c2
Tags:golang GoShell injector Shellcode

Intelligence

File Origin
# of uploads :
2
# of downloads :
338
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a70b749e1d8a236e343ddbdf9d19e7b8
Verdict:
No threats detected
Analysis date:
2021-02-27 17:00:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/60d22a56-e3dc-4c3b-8e7d-09a8ab982105

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/119678/
Detection(s):
SecuriteInfo.com.Troj.Rozena-Z.21949.10491.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Connection attempt
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/620600
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b7e0a21e13f1607ef431f54a44902d9250a0d21420cc1618481bea5b1dee86a/
Threat name:
Win64.Trojan.Rozena
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 01:02:17 UTC
File Type:
PE+ (Exe)
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
463218064d1dfba957ebcbb0abb90782106f6e4b173e7b1c207b20a605ebbab9
4961954c47ef2395dd73b8cc4bb36827f71e08a13f9ec4cc1daba51715334fc9
4c433048f3e18eac45505cc860215a304e3bc9267cef376f65af100424d36b7f
8c0a1741bd3443e6d61bcc0d92033feedeccbf78abede26fbbf4d2a9089ea9d9
9b921d4c8c3eea84615365d78a2e7223ebf42764aa1b61122762b950bee3ea4a
9d701a6eab150c0140c0153c4b6c1f3dbc0a44845722b79bfa75a98c200113fa
9f84130cc5240f4df5afc674fde40012dd9ff141a28dfd171fbd0db9747dbc39
d54b73a94d481ee2917e42ba3d4ea3b70f368bb13cebf5b8824257907ac84ff1
e453400f413b4ad2e996c28b7e72be2d42fc2a8d30e9c91a67a0e0e6915aff7f
ec2f156359e30aaf1929dff8f4b97deba32fe642d7fb8a76ba2346605c2d94d0
+ 12 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/210227-g4226x96n6/
Behaviour
Cobaltstrike
Unpacked files
SH256 hash:
9b7e0a21e13f1607ef431f54a44902d9250a0d21420cc1618481bea5b1dee86a
MD5 hash:
a70b749e1d8a236e343ddbdf9d19e7b8
SHA1 hash:
9bd3d01e68d23beab8a6124296074e124938147e
Link:
https://www.unpac.me/results/59bc05f9-df80-4dc0-8596-b5c63be9deca/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9b7e0a21e13f1607ef431f54a44902d9250a0d21420cc1618481bea5b1dee86a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/c3rb3ru5d3d53c/status/1365683298295496710
Cape
Cape
https://www.capesandbox.com/analysis/119678/

Comments