MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd735048e84f832db250acf7e9238d8c2a23e10600a48b45351ac6fe315c7050. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd735048e84f832db250acf7e9238d8c2a23e10600a48b45351ac6fe315c7050
SHA3-384 hash: 523019bb8bae4a89b2eb81ca6fff06c522cb2aa5feb58b214b652e270e0fb2d89949427562300c0adee5521b43b67103
SHA1 hash: 06cfa8a406920f8a31eedb9326f95f742d4de328
MD5 hash: 5231caa157ed6de9f8d56a9527e996b5
humanhash: salami-king-mars-harry
File name:dd735048e84f832db250acf7e9238d8c2a23e10600a48b45351ac6fe315c7050
Download: download sample
File size:3'978'928 bytes
First seen:2020-09-01 09:18:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 63f8a3e701f3eac2ada72b261b052d32
ssdeep 49152:zFIVGhAF+TT9BTvLEGk1BHqhEqY5Oz6C7nyYobAqi6jZd4HFUrM:zGV69FC1BHqhA6nUAW1d4N
Threatray 45 similar samples on MalwareBazaar
TLSH D6067D02F7905025F5B31AB949AFA168A93DBA911B28A0C772DC1EDC5F75BE07C31393
Reporter JAMESWT_WT
Tags:Ample Digital Limited

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/53886/
Detection(s):
PUA.Win.Packer.Exe-6
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Trojan.Generic-6629273-0
Create hunting rule

PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Deleting a system file
Running batch commands
Creating a process with a hidden window
DNS request
Changing a file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/456328
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 280549 Sample: pSUl0NcQZB Startdate: 01/09/2020 Architecture: WINDOWS Score: 56 20 Antivirus / Scanner detection for submitted sample 2->20 22 Multi AV Scanner detection for submitted file 2->22 7 pSUl0NcQZB.exe 3 6 2->7         started        process3 dnsIp4 14 nJI.75cs.com 7->14 16 c.75cs.com 7->16 18 2 other IPs or domains 7->18 10 cmd.exe 1 7->10         started        process5 process6 12 conhost.exe 10->12         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd735048e84f832db250acf7e9238d8c2a23e10600a48b45351ac6fe315c7050/
Threat name:
Win32.Trojan.Woool
Create hunting rule
Status:
Malicious
First seen:
2020-07-18 16:38:00 UTC
File Type:
PE (Exe)
Extracted files:
102
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
11752b5276ee16c5aad18bd90480f51f707acef77a440a04030a4c6b4b0f144e
3a509e802831371c7bf1d69240980807db6fb2ea024e5c20eb83e62e0d7aa424
6819d725c2e35db9085e02233b20812ff24bdb0b62d07f3ddbd25caa2c19b64b
70dfab9ffb2930b2039ba78146150b6fb1ca12da19d23b18f4339488f7ccfd82
895abcd33e96522cc950a56ecc683e6fd340fe1f83dbbc61336fdbb16ac0c5ea
aace31706cb1354cace75314f42e73f930e954675230883a2ff39470264fe59c
ae908fa923abade520fd1563f88af3f20913d19dcb8e50601079eeca059e5993
b97f81682580a6bb92848e0b058df756c38606deb940725628895d05d035b565
e1d49dbd664cc8b4371fcd0d57da951aec767532252452d81f52d39cfb42a856
e62bafeac7136563e3c3b21d94daa7b5688e8f527dbb894d854c018e339df101
+ 35 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200901-yzx98kj8vx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies data under HKEY_USERS
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Drops file in Drivers directory
Drops file in Drivers directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
OnLineGames
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd735048e84f832db250acf7e9238d8c2a23e10600a48b45351ac6fe315c7050

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/53886/

Comments