MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 077c87d4fef3f9c93485d04bebcfc01bd976f76c93b165a8b02a35545aa41436. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 077c87d4fef3f9c93485d04bebcfc01bd976f76c93b165a8b02a35545aa41436
SHA3-384 hash: 9c0a818952410246de452f404f335dbd6a1f1985c933d99b19a449e1904c867c5a9b776a57ea2a6fa3995ecb2f3df4e8
SHA1 hash: fefe73e09feeade882a34b8b73d74ce491bce652
MD5 hash: 663b576708dccc8621bb21fa688fecd9
humanhash: beryllium-stream-tennessee-coffee
File name:077c87d4fef3f9c93485d04bebcfc01bd976f76c93b165a8b02a35545aa41436
Download: download sample
File size:207'360 bytes
First seen:2020-11-10 10:59:13 UTC
Last seen:2024-07-24 10:56:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1c7ab0e4c183931415ff18e5405878d9 (2 x ZeuS)
ssdeep 3072:oZ1MZbzSx8vhDVgfq/LVWfQm0cXE9lr3Nh7JYoONRNGKtKTkAVVeYaiXpOG:o3ybex81X/L0fQQ09lr9vGNGOKQ+SCP
Threatray 3 similar samples on MalwareBazaar
TLSH ED14236CFE89DC2CCB7AA2731210C7D844BFD7449590ABDAC2DCC15AA93A9658C1DC0B
Reporter seifreed

Intelligence

File Origin
# of uploads :
2
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-4
Create hunting rule

SecuriteInfo.com.Mal.EncPk-ABF.23660.18941.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/077c87d4fef3f9c93485d04bebcfc01bd976f76c93b165a8b02a35545aa41436/
Threat name:
Win32.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 11:01:09 UTC
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
4c850cfff31192c9f8439e0b9e4127d0b419c9909d2c85e7e99a5bb0115db3c9
4e49f5147939257640ba4990f520c9dbe355c83b73d9deadfc8505c4a09f931d
94c9336a6e056520105481a9082e7e84c8a98a794a06b037c573bd9efc9df809
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201110-778qr8wmbx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
UPX packed file
Unpacked files
SH256 hash:
077c87d4fef3f9c93485d04bebcfc01bd976f76c93b165a8b02a35545aa41436
MD5 hash:
663b576708dccc8621bb21fa688fecd9
SHA1 hash:
fefe73e09feeade882a34b8b73d74ce491bce652
Link:
https://www.unpac.me/results/730e8f04-0d6a-4d5a-8a4d-e1e0e88367ae/
SH256 hash:
8d23f703dfa16de953134a0e88f5eb9331fbc4101d649cbfd6b6f21c3a78c702
MD5 hash:
6ce57bb299a5a61dcd876b417f0480ad
SHA1 hash:
fd3e44212a5329fbe5b9c7229d747a469d6b347d
Link:
https://www.unpac.me/results/730e8f04-0d6a-4d5a-8a4d-e1e0e88367ae/
SH256 hash:
640fdc1f640cc042ae53e175e77c9b3a3fd0a69a99e1f27befb54a2a500241c1
MD5 hash:
45d236a9fdd6718bdba9dff9d6dee77c
SHA1 hash:
bdf584d504f4b0d93cb5469dd6252da58398bd63
Link:
https://www.unpac.me/results/730e8f04-0d6a-4d5a-8a4d-e1e0e88367ae/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments