MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b48c6ee90905955194c2864cd4ff8618c7df2a301df6740ce9f9065f5cb04fa9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Downloader.Upatre

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	b48c6ee90905955194c2864cd4ff8618c7df2a301df6740ce9f9065f5cb04fa9
SHA3-384 hash:	79e3099fbe4878564bb0617ef93e4952c21e427469c9a397d4875ae6d8806915447986935c751d041f87a7bea4cc3592
SHA1 hash:	556199c8f60b485e6310a93747f7e16c01fca892
MD5 hash:	ace1743de37105aeb5e6cf139a027e5a
humanhash:	lemon-cold-monkey-fifteen
File name:	Purchase Order.bat
Download:	download sample
Signature	Downloader.Upatre Create hunting rule
File size:	651'264 bytes
First seen:	2020-07-11 06:08:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ed59877d8a7e80fc65ba5bc1fc957178 (1 x Downloader.Upatre)
ssdeep	12288:/XMipawXMnpayKCcKNR+Xy46A9jmP/uhu/yMS08CkntxYRM:/XMipawXMnpaDjKN8fmP/UDMS08Ckn3Z
Threatray	755 similar samples on MalwareBazaar
TLSH	C0D4AE13E904B00FD552C8B1A9A9A55F4A357DBA1154AD07BBC1AF0D71B27C3A8FA30F
Reporter	abuse_ch
Tags:	bat Downloader.Upatre

abuse_ch

Malspam distributing unidentified malware:

HELO: smtp.easynet.es
Sending IP: 213.139.0.17
From: sales manager <presidant.1@pediatrian.com>
Subject: Payment advise and new PO
Attachment: Purchase Order.rar (contains "Purchase Order.bat")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

Win.Downloader.Upatre-6819499-0

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a window

Using the Windows Management Instrumentation requests

Running batch commands

Creating a process with a hidden window

Creating a file

Searching for the window

Deleting a recently created file

Replacing files

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b48c6ee90905955194c2864cd4ff8618c7df2a301df6740ce9f9065f5cb04fa9/

Threat name:

Win32.Spyware.Kutaki

Status:

Malicious

First seen:

2020-07-11 06:10:08 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wsgg52ijawkvdfgcqzgnj74gddd56krqdx3hidhj7edf6xfqj6uq._file

Verdict:

malicious

Downloader.Upatre

2ea5a4fb25528051254f255dc64913ca7d4faa1ecba2f40a55b536f871624fb9

Downloader.Upatre

4fbe77777093608a25b248db192e96bb062da46835e2739c07922c39cfbb0d57

Downloader.Upatre

5c883c457a3dc0ddd6ae66380087c57fb714bdf90ff79185ae0cac329677fe26

Downloader.Upatre

736cb1644adf35fc139e7031d9bc5073816784d21b34de83260387f47f13ba43

Downloader.Upatre

77985fca7ae6b60c8025ba326e3bd1d9949c3fb32b9ca0f99f040be633823a7c

Downloader.Upatre

b3ea819ddfabf3e2060d9f8116e0952654d5bcdb5716f84ad142a6ab979b521a

Downloader.Upatre

bb6cfee282efc5fa0e2dd8de410f4f7b9e684a3378244948589516d9ffaa81ad

Downloader.Upatre

bbcb85929cfc7f9761b8bbbd06f473b2ad14b885e1cc2874c2f94d14af2b0b6a

Downloader.Upatre

d0c571182eb67023db9b2f8c440dfc76488b23ea51819de40bbeca16fbb9322e

Downloader.Upatre

+ 745 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/200711-d1ndspk8gs/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_kutaki_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	win_vobfus_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator