🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 061e17f3b2fd4a4dce1bf4f8a31198273f1abc47c32456d06fd5997ea4363578. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Kimsuky


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 061e17f3b2fd4a4dce1bf4f8a31198273f1abc47c32456d06fd5997ea4363578
SHA3-384 hash: 7736c3fa9fc339d5a1240f8bb8db096bb5a4bb8e0deac693e13d02514b2f3b9e488b403dcf2966cb8758a13a5529169c
SHA1 hash: 75c799dc33263eb6c83db7710b3a2a263adf80f0
MD5 hash: dae0efd29230feab95f46ee20030a425
humanhash: purple-steak-salami-mango
File name:_Pyongyang in talks with Moscow on access to Donbass.pptx
Download: download sample
Signature Kimsuky
Create hunting rule
File size:12'616 bytes
First seen:2022-08-26 09:00:11 UTC
Last seen:Never
File type:PowerPoint file pptx
MIME type:application/vnd.openxmlformats-officedocument.presentationml.presentation
ssdeep 192:xrXP/oxIAJrfhBPnTACqVsXCdGjYQPWhSJnUEoUwU4+PkVhDYcy0nsHKxdlxw5f0:dXPANJpJfqWEGTWhS5HoLMcjsiQP0Xdr
TLSH T16542BE23B8A2F19AD979CB3E47BE04FE0A3B68012D419E2F3300E1A576551536B0B935
TrID 64.8% (.PPAM) PowerPoint Macro-enabled Open XML add-in (41500/1/5)
27.3% (.ZIP) Open Packaging Conventions container (17500/1/4)
6.2% (.ZIP) ZIP compressed archive (4000/1)
1.5% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter Jagdtiger88mm
Tags:Kimsuky pptx Russia

Intelligence

File Origin
# of uploads :
1
# of downloads :
24'604
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_Pyongyang in talks with Moscow on access to Donbass.pptx
Verdict:
No threats detected
Analysis date:
2022-08-26 09:03:24 UTC
Tags:
macros macros-on-open
Link:
https://app.any.run/tasks/fa26d99d-74ee-46dd-9514-a01af0cdec18

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
MiscreantPunch.EvilMacro.CMDCB64A.1.UNOFFICIAL
Create hunting rule

MiscreantPunch.EvilMacro.PSHELLB64.1.UNOFFICIAL
Create hunting rule

MiscreantPunch.EvilMacro.PSHELLB64.15.UNOFFICIAL
Create hunting rule

Sanesecurity.Badmacro.Doc.vbh.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.CertutilLOLBinHumanAferAll.20210225.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.CREATEOBJECT.220301B64.3.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.POWERSHELL.200302B64.13.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.POWERSHELL.200302B64.6.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.WSCRIPT.SHELL.200129B64.7.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.STRINGBUILDERCaliNights.20210823.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Legacy PowerPoint File with Macro
Link:
https://app.docguard.net/061e17f3b2fd4a4dce1bf4f8a31198273f1abc47c32456d06fd5997ea4363578/results/dashboard
Payload URLs
URL
File name
192.168.10.10
vbaProject.bin
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
certutil cmd macros macros-on-open ping wscript
Link:
https://www.filescan.io/uploads/63088bd26a5c2490f87fc9e2/reports/9f61fe04-72c7-4e58-8c6d-d5839dd8bc41/overview
Label:
Malicious
Suspicious Score:
9.9/10
Score Malicious:
1%
Score Benign:
0%
Link:
https://www.malware.ai/gui/files/?id=6f8af8d1-05d7-45eb-b199-1f7caa8970e2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/061e17f3b2fd4a4dce1bf4f8a31198273f1abc47c32456d06fd5997ea4363578/
Threat name:
Document-Office.Dropper.Powdow
Create hunting rule
Status:
Malicious
First seen:
2022-08-18 09:52:37 UTC
File Type:
Document
Extracted files:
15
AV detection:
12 of 25 (48.00%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aypbp45s7vfe3tq36t4kgemye47rvpchymsfnudp2wmx5jbwgv4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/061e17f3b2fd4a4dce1bf4f8a31198273f1abc47c32456d06fd5997ea4363578

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments