🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02f79fab5c5cec65fcbd8ad039537afbe7badc815d55e63d031ae527f4a7bbd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02f79fab5c5cec65fcbd8ad039537afbe7badc815d55e63d031ae527f4a7bbd5
SHA3-384 hash: 1983ef03234c08ce45ca3626de6ecdd1b92c9e8016e97ceb2ea906b2cc3f133aff4a55d3ae32a1eaa05fde1424129b70
SHA1 hash: 1e98ff12a5f4a390bbceae538e1177a65ad52dad
MD5 hash: 938b2e065955369403bd5ed78c063b44
humanhash: fix-virginia-stairway-undress
File name:938b2e065955369403bd5ed78c063b44
Download: download sample
File size:4'501'504 bytes
First seen:2021-06-24 00:12:17 UTC
Last seen:2021-08-09 08:24:42 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:uv6N57PzcuQv+CUUz1tu5hrNGrKpDuBXLKd/MTzgWUD5:Gi5cuM+Qu3pGrK9kOdvFd
Threatray 3 similar samples on MalwareBazaar
TLSH CC263332F8D15F7FD7BA053194AFC662957EED201E20CD0B6768740A39B24A113F672A
Reporter zbetcheckin
Tags:msi

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Polazert.8.25110.17029.UNOFFICIAL
Create hunting rule

Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
45 / 100
Link:
https://www.joesandbox.com/analysis/806970
Signature
Adds a directory exclusion to Windows Defender
Disables Windows Defender (via service or powershell)
Sigma detected: Powershell adding suspicious path to exclusion list
Sigma detected: Powershell Used To Disable Windows Defender AV Security Monitoring
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 439381 Sample: XZJP5R1UWq Startdate: 24/06/2021 Architecture: WINDOWS Score: 45 33 Sigma detected: Powershell adding suspicious path to exclusion list 2->33 35 Sigma detected: Powershell Used To Disable Windows Defender AV Security Monitoring 2->35 8 msiexec.exe 1 2->8         started        10 msiexec.exe 2->10         started        12 msiexec.exe 5 2->12         started        14 j_service.exe 2->14         started        process3 process4 16 cmd.exe 1 8->16         started        signatures5 29 Adds a directory exclusion to Windows Defender 16->29 31 Disables Windows Defender (via service or powershell) 16->31 19 cmd.exe 1 16->19         started        21 powershell.exe 3 22 16->21         started        23 powershell.exe 26 16->23         started        25 15 other processes 16->25 process6 process7 27 powershell.exe 24 19->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02f79fab5c5cec65fcbd8ad039537afbe7badc815d55e63d031ae527f4a7bbd5/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-06-24 00:12:29 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0d245d45e6c96ffa4baf8b8be6cc7b0d15165b2398c420a9ad70788e7a1f88d7
122ec58305457383ce015846fe9598d3ff42c7eae8de6d936d5751b31e75b18f
90394647034a0ebfcce39fb61261e2df0cfeddbcc9359cd432e6d800e6af3da6
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery exploit
Link:
https://tria.ge/reports/210624-cedwdgmhee/
Behaviour
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Enumerates connected drives
Loads dropped DLL
Modifies file permissions
Blocklisted process makes network request
Executes dropped EXE
Possible privilege escalation attempt
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/02f79fab5c5cec65fcbd8ad039537afbe7badc815d55e63d031ae527f4a7bbd5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi 02f79fab5c5cec65fcbd8ad039537afbe7badc815d55e63d031ae527f4a7bbd5

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1393011/

Comments