MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02f0bbe79e7b4fbda98d68a49691f8a9c0b019437b146e3f509730181eb74f1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02f0bbe79e7b4fbda98d68a49691f8a9c0b019437b146e3f509730181eb74f1c
SHA3-384 hash: 7a936f539e4b46d7f278edb663ed5a68043dd2c81a74c27e2376ae82866a969be2cfb5077014aa980217ccc49fd54f83
SHA1 hash: 6e2a6ca3134426145e4e0070cb646dc8f8cc01bd
MD5 hash: f91479572a6eb6f0bb81ca864c172845
humanhash: river-sad-berlin-beryllium
File name:f91479572a6eb6f0bb81ca864c172845.exe
Download: download sample
File size:3'300'864 bytes
First seen:2021-12-17 10:15:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 61c3df730291850fea0c9a7171786100 (13 x CoinMiner)
ssdeep 98304:Q/dZnW9DwKRtmy/dH/evSmYb/+Zh6j3oV:Q//WyKR8KzmYzDj3oV
Threatray 62 similar samples on MalwareBazaar
TLSH T1C5E52393F45E9EFDC507243696A1302A5F0E26330EE75660579D936F72E3973028BA8C
Reporter abuse_ch
Tags:exe Telegram

Intelligence

File Origin
# of uploads :
1
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://95.181.153.56/Ab2d9j2da.exe
Verdict:
Malicious activity
Analysis date:
2021-12-16 04:42:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a1cbd666-bb0d-41c6-aeee-68a6e3f8199d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/214772/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Running batch commands
Launching a process
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Creating a window
Searching for the window
Blocking the Windows Defender launch
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Malware family:
n/a
Score:
  0/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/2367/overview
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61bc636acb311996709e752c/reports/f297a579-4119-4ea9-9202-353351abd449/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7412660a-234e-4078-b0cb-0ce539c28458
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
66 / 100
Link:
https://www.joesandbox.com/analysis/909006
Signature
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (overwrites its own PE header)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Uses the Telegram API (likely for C&C communication)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 541481 Sample: aHqBKlgzSs.exe Startdate: 17/12/2021 Architecture: WINDOWS Score: 66 55 Multi AV Scanner detection for submitted file 2->55 57 Machine Learning detection for sample 2->57 59 Uses the Telegram API (likely for C&C communication) 2->59 61 PE file has nameless sections 2->61 7 aHqBKlgzSs.exe 1 22 2->7         started        12 RegHost.exe 22 2->12         started        process3 dnsIp4 53 github.com 140.82.121.4, 443, 49760, 49761 GITHUBUS United States 7->53 45 C:\Users\user\AppData\Roaming\...\RegHost.exe, PE32+ 7->45 dropped 63 Detected unpacking (overwrites its own PE header) 7->63 65 Creates HTML files with .exe extension (expired dropper behavior) 7->65 67 Hides threads from debuggers 7->67 14 WerFault.exe 20 9 7->14         started        17 cmd.exe 1 7->17         started        19 cmd.exe 1 7->19         started        30 2 other processes 7->30 69 Multi AV Scanner detection for dropped file 12->69 71 Machine Learning detection for dropped file 12->71 21 WerFault.exe 17 9 12->21         started        24 cmd.exe 1 12->24         started        26 cmd.exe 1 12->26         started        28 conhost.exe 12->28         started        file5 signatures6 process7 dnsIp8 47 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 14->47 dropped 32 curl.exe 1 17->32         started        35 conhost.exe 17->35         started        37 conhost.exe 19->37         started        51 192.168.2.1 unknown unknown 21->51 39 conhost.exe 24->39         started        41 conhost.exe 26->41         started        43 conhost.exe 30->43         started        file9 process10 dnsIp11 49 api.telegram.org 149.154.167.220, 443, 49759 TELEGRAMRU United Kingdom 32->49
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02f0bbe79e7b4fbda98d68a49691f8a9c0b019437b146e3f509730181eb74f1c/
Threat name:
Win64.Trojan.Vimditator
Create hunting rule
Status:
Malicious
First seen:
2021-12-16 15:47:26 UTC
File Type:
PE+ (Exe)
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
17cf75eb6b87af72f6fbddbe3ce9653f74ef56718198160c454086bb87866676
3426d12d872333a290c333ef0cff53ccd94966fe5826106ebc3d819cf078698b
565b1484478b1644bd1e8954e079f653b8f71c9f16997d4b7fc53f83da609e35
6467af2474360133a3d9fd753097c250d5673f5a6a8b58fd5ac773486cd1ae7c
735b327fa288036469c2b9bfd97ad7b75900f7a8980dae26e40188dbeb425993
73942b1b5a8146090a40fe50a67c7c86c739329506db9ff5adc638ed7bb1654e
c14c17020a470e53754dc2654847e9fbc6fa6f0326e515d10c6a581ad2c8825f
c937ab727bd34bd8c83e2ea01054cd60363ca35bd99fccf46b1f1f1f119715db
ed3b91ec20184139f90c2432c7d90567dc9c47afc45a87bb4d72fa4a6c64edd9
+ 52 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan
Link:
https://tria.ge/reports/211217-mas4lsddh7/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Modifies Windows Defender Real-time Protection settings
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
02f0bbe79e7b4fbda98d68a49691f8a9c0b019437b146e3f509730181eb74f1c
MD5 hash:
f91479572a6eb6f0bb81ca864c172845
SHA1 hash:
6e2a6ca3134426145e4e0070cb646dc8f8cc01bd
Link:
https://www.unpac.me/results/ddef1ad1-9fcd-46d1-a210-acee2f125209/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/02f0bbe79e7b4fbda98d68a49691f8a9c0b019437b146e3f509730181eb74f1c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defedner features
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:XOREngine_Misc_XOR_Func
Create hunting rule
Author:smiller cc @florian @wesley idea on implementation with yara's built in XOR function
Description:Use with care, https://twitter.com/cyb3rops/status/1237042104406355968

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/214772/

Comments