MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d69389d43f6a551acba49cb72681b92fe838725f116610a81f23ef25bb6f7f24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d69389d43f6a551acba49cb72681b92fe838725f116610a81f23ef25bb6f7f24
SHA3-384 hash: 930a32eb67e99ae22e171885b9adbc89d3a4c00be73b11bd2050aa68331772153ad9e051c35d1c1c48ec1e16748875ae
SHA1 hash: 46abfa762a36c019cc788cf3f3346a32dcb37759
MD5 hash: b7ef7b4985ba9c57aaf39c86d7fdcfe2
humanhash: alanine-lake-delta-lima
File name:malware_with_signature_Accelerate Technologies Ltd (20)
Download: download sample
File size:1'050'144 bytes
First seen:2020-08-29 08:17:13 UTC
Last seen:2020-08-29 08:36:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a999dbaec2f24ae6d6f85931eacd8ed2
ssdeep 24576:3g8jVE+E9AROKGq44MgUceV4fgo92S2R0:3g6q+NRrG4tEe
Threatray 7 similar samples on MalwareBazaar
TLSH AF252B7DE70625F4E627A2B1819EEB775B18BA598032AE7FFF4FC604B0334122D49095
Reporter JAMESWT_WT
Tags:Accelerate Technologies Ltd

Code Signing Certificate

Organisation:Accelerate Technologies Ltd
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:Mar 7 00:00:00 2020 GMT
Valid to:Mar 4 23:59:59 2021 GMT
Serial number: B3F906E5E6B2CF61C5E51BE79B4E8777
Intelligence: 35 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 2B48363D587B11F2726D343E0ED1D76A2E4ADBC4A383C30CDAE41ADE0006B224
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/52818/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Spy.18178.31652.43.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Unauthorized injection to a recently created process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/454198
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d69389d43f6a551acba49cb72681b92fe838725f116610a81f23ef25bb6f7f24/
Threat name:
Win32.Dropper.NetTraveler
Create hunting rule
Status:
Malicious
First seen:
2020-08-26 03:40:00 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 29 (72.41%)
Threat level:
  3/5
Verdict:
unknown
Similar samples:
44979b3e2e49934c1b0a344711408cfe8d19c54c0c177cbc80425955b1d71b3d
46552aa0ea1419bb208ac1d67ae7c39e1573aabc82080fdff968a0c1867d0a22
a991f1aac4e086eaa96da23639f871b5629b4987a7a9203537a062075e8384e8
b70d7b1731c2e5af3847a1d54d746c376f676b3ca37bc8df31d0c1eba671ba79
c1d7731ac02354dce14bf98a56a00f0b908fa2d8dcb3375bee86fa3aca8d79f7
d0d8ca50b3046b2c5a6a992a4a4308e449e897446dcfefef9d0c4640538f9965
eab1c7370e4fe2a6b0798f4c9cb2cae10297acf31788a39bdcabe78c697d9336
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/200829-y37dnyn61s/
Behaviour
Suspicious use of WriteProcessMemory
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/d69389d43f6a551acba49cb72681b92fe838725f116610a81f23ef25bb6f7f24

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NetTraveler
Create hunting rule
Author:Katie Kleemola
Description:Nettravelr
Rule name:NetTravExports
Create hunting rule
Author:Katie Kleemola
Description:Export names for dll component
Rule name:NetTravStrings
Create hunting rule
Author:Katie Kleemola
Description:Identifiers for NetTraveler DLL
Rule name:win_nettraveler_w0
Create hunting rule
Author:Katie Kleemola
Description:Identifiers for NetTraveler DLL
Rule name:win_nettraveler_w2
Create hunting rule
Author:Katie Kleemola
Description:Export names for dll component

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/52818/

Comments