MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20
SHA3-384 hash: ab83199255e0285bb20b1ab2eea762751c6b038c2f2b6be83dcc56bb11f20c18c43bf2bb1d6b8c5298c138fcc00448a8
SHA1 hash: 1d6e1f03ba4d0f0d92b13ca59515777510e4fd0c
MD5 hash: fc01bd7c34525de0ffaf784bfeb094d2
humanhash: happy-salami-pasta-massachusetts
File name:fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20
Download: download sample
File size:3'998'288 bytes
First seen:2020-09-01 09:18:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1deac0af3e6e6b3d3bdd06e9d477f731
ssdeep 49152:F6i8YG6po+T1zEGk1BHqhEqY5Oz6C7nyYobAqSeHUq9r3CwoX3q0:F6i8Y9C1BHqhA6nUAnazO
Threatray 47 similar samples on MalwareBazaar
TLSH A9069D11B7905025F9B31AB949AFA168993DBAE11728A0CB72DC1ECC5F75BE07C31393
Reporter JAMESWT_WT
Tags:Ample Digital Limited

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/53885/
Detection(s):
PUA.Win.Packer.Exe-6
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Trojan.Generic-6629273-0
Create hunting rule

PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Deleting a system file
Running batch commands
Creating a process with a hidden window
DNS request
Creating a file in the Windows subdirectories
Deleting a recently created file
Creating a file in the drivers directory
Creating a service
Launching a service
Loading a system driver
Creating a file in the Windows directory
Sending an HTTP POST request
Sending an HTTP GET request
Enabling autorun for a service
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/456334
Signature
Antivirus / Scanner detection for submitted sample
Changes security center settings (notifications, updates, antivirus, firewall)
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Sample is not signed and drops a device driver
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 280553 Sample: wblvHZuOW6 Startdate: 01/09/2020 Architecture: WINDOWS Score: 76 50 Antivirus / Scanner detection for submitted sample 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 NDIS Filter Driver detected (likely used to intercept and sniff network traffic) 2->54 56 Machine Learning detection for sample 2->56 7 wblvHZuOW6.exe 5 2->7         started        12 svchost.exe 2->12         started        14 svchost.exe 1 1 2->14         started        16 8 other processes 2->16 process3 dnsIp4 42 c.75cs.com 7->42 44 b.75cs.com 7->44 48 2 other IPs or domains 7->48 34 C:\Windows\SysWOW64\drivers\dto1.exe, PE32 7->34 dropped 36 C:\Windows\SysWOW64\driversbehaviorgraphmProtect.sys, PE32 7->36 dropped 38 C:\Windows\SysWOW64\...behaviorgraphmProtect-x64.sys, PE32+ 7->38 dropped 40 C:\Windows\SysWOW64\drivers\ProtectApi.dll, PE32 7->40 dropped 60 Drops executables to the windows directory (C:\Windows) and starts them 7->60 62 Sample is not signed and drops a device driver 7->62 18 dto1.exe 2 7->18         started        22 cmd.exe 1 7->22         started        64 Changes security center settings (notifications, updates, antivirus, firewall) 12->64 24 MpCmdRun.exe 1 12->24         started        46 127.0.0.1 unknown unknown 14->46 file5 signatures6 process7 file8 32 C:\Windows\System32\drivers\769121AB.sys, PE32+ 18->32 dropped 58 Sample is not signed and drops a device driver 18->58 26 conhost.exe 18->26         started        28 conhost.exe 22->28         started        30 conhost.exe 24->30         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20/
Threat name:
Win32.Trojan.Woool
Create hunting rule
Status:
Malicious
First seen:
2020-07-27 04:54:00 UTC
File Type:
PE (Exe)
Extracted files:
102
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
025c02b41a8f743e5787b57e74631316db62317c41845402f3ad5e0575b6586e
0d47d1c6e21e6df01ac6593d252993b93a0a00a645e1687c2b75cd0b7656ec2b
123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e
16566bcc907929b1251cf158430a0e336cfd0269be8683d928f820a78703e53d
326767b296e7de3941d974bb9abde500b5b7cbefe4a080ab33e6a5b9a69c3070
4a46a253a8201ca8dd7be2be8ce8cdab7bd5cb5c39d7a87adaa03e96c3187be8
561fe3832a5681034418efd005c0f2ebae8b9a54efa6d52761980fe6b3a31337
707330f0f7009aeb6cb1bba679ac72183ed938293fc5c2a4ecea035f245b789c
78d35a3dafd0617427465e820f9b337531df9ff263853e84a7d2e6cfb1a5faa6
c79f3e70d3993f9da3f7b010f8a1610ee52919191bb29e2359305b1b75f1a6b3
+ 37 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200901-tdb37wlp6a/
Behaviour
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Loads dropped DLL
Loads dropped DLL
Drops file in Drivers directory
Executes dropped EXE
Drops file in Drivers directory
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fdb370e507a2dafd896f539be1e63bad7dd1963259606df11208f5e1498e6f20

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/53885/

Comments