MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07b823d46608cb550c01e93deef903cf3f311228a668bc93cfc69aec216d18a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07b823d46608cb550c01e93deef903cf3f311228a668bc93cfc69aec216d18a9
SHA3-384 hash: 1c21febf09ec496ad860c3c815ad3dcc11f1acd05c5fda6ebc168ccfa0d449870d5230487ad6379346e57af514969bfb
SHA1 hash: efa0d86f8363c87ca1407ae9ec8f44cb039e7c31
MD5 hash: 5e055aac810806e46828d518e27883a9
humanhash: red-alanine-stream-mango
File name:Contactouwjoyyo_Dyr_BGjAA%SG_xqa(249691035600Contacto.bat
Download: download sample
File size:5'331 bytes
First seen:2021-06-28 20:24:04 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 96:93Pf3sT3Pf35ApPTQj2R36KZ0LexHBZ8zlI5uoXD58l0JNOalgGlwzAlOv+Tlpwb:NULxApPTN36KiiNBZ852by
TLSH C2B1B7EAE682AB1B2D0A836699F78EB6FCDF40FF517200A744002354F1ADBDD594E443
Reporter Anonymous

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fea6af6b-5c1f-4f30-9c80-fc58b9ba218a
Verdict:
Suspicious activity
Analysis date:
2021-06-28 23:47:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9237df83-4d99-4974-ad0f-90a47ba5dc7e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan-Dropper.BAT.Agent.dv.25145.12514.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
evad
Score:
24 / 100
Link:
https://www.joesandbox.com/analysis/809135
Signature
Bypasses PowerShell execution policy
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 process2 2 Behavior Graph ID: 441541 Sample: Contactouwjoyyo_Dyr_BGjAA%S... Startdate: 29/06/2021 Architecture: WINDOWS Score: 24 6 cmd.exe 1 2->6         started        signatures3 26 Bypasses PowerShell execution policy 6->26 9 cmd.exe 1 6->9         started        11 cmd.exe 1 6->11         started        13 conhost.exe 6->13         started        15 2 other processes 6->15 process4 process5 17 powershell.exe 14 29 9->17         started        20 cmd.exe 1 9->20         started        22 chcp.com 1 11->22         started        dnsIp6 24 52.190.4.223, 80 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 17->24
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07b823d46608cb550c01e93deef903cf3f311228a668bc93cfc69aec216d18a9/
Threat name:
Script-BAT.Trojan.Oneeva
Create hunting rule
Status:
Malicious
First seen:
2021-06-28 20:24:11 UTC
AV detection:
3 of 46 (6.52%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/07b823d46608cb550c01e93deef903cf3f311228a668bc93cfc69aec216d18a9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Batch (bat) bat 07b823d46608cb550c01e93deef903cf3f311228a668bc93cfc69aec216d18a9

(this sample)

Executable exe 20691095f8e73e8f1910cd88542ff81adb40b23af4af133d7b9cfb2faa08692e

  
Dropping
SHA256 20691095f8e73e8f1910cd88542ff81adb40b23af4af133d7b9cfb2faa08692e
  
Dropping
SHA256 f442ad7ecf750caad3de8f8109768782532bfcb7a09221a72a7afc6519f79cfc
  
Delivery method
Distributed via e-mail link

Comments