MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a05b5e9592ce681e4be9b0739188f525016268247b7d78311755dc0af20d85a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a05b5e9592ce681e4be9b0739188f525016268247b7d78311755dc0af20d85a
SHA3-384 hash: 1b40b794c8561d6c4385dd88fc5cf04e43681e8eefb6b149a830242690d3ec743b2710b90ac7ba7a7a51ef125a481cd8
SHA1 hash: 78ff0ad557e0aa7e669fc52ad631c55becf5465d
MD5 hash: 035f00537e8f88bd0c12bcffc00e8bed
humanhash: failed-edward-fish-white
File name:b0d1ec6d6a2c7ecfce2172985f16b0cd
Download: download sample
File size:27'136 bytes
First seen:2020-11-17 15:46:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 87bed5a7cba00c7e1f4015f1bdae2183 (3'034 x Jadtre, 23 x IcedID, 17 x Blackmoon)
ssdeep 768:xd5u7mNGtyVfvATsQGPL4vzZq2o9W7GqxeIx6:xd5z/fvAvGCq2iW7f
TLSH 5AC2C072CE8090FFC0CF3432208522CB9B175A72A56A6867A750981E7DBCDD0E977753
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Malware.Vtflooder-6260355-1
Create hunting rule

Win.Malware.Cerbu-9789017-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Changing an executable file
DNS request
Modifying an executable file
Connection attempt
Sending an HTTP POST request
Creating a file
Running batch commands
Creating a process with a hidden window
Creating a file in the %temp% directory
Creating a process from a recently created file
Connection attempt to an infection source
Infecting executable files
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a05b5e9592ce681e4be9b0739188f525016268247b7d78311755dc0af20d85a/
Threat name:
Win32.Virus.Wapomi
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 15:55:03 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Unpacked files
SH256 hash:
0a05b5e9592ce681e4be9b0739188f525016268247b7d78311755dc0af20d85a
MD5 hash:
035f00537e8f88bd0c12bcffc00e8bed
SHA1 hash:
78ff0ad557e0aa7e669fc52ad631c55becf5465d
Link:
https://www.unpac.me/results/b30ed312-5760-43d9-b692-0fda4a4e13f3/
SH256 hash:
77081790a200ece25251284e836234feec71bc74f648361406685a4527e3d517
MD5 hash:
ad76ab6a68febda3c3704654e63acbaa
SHA1 hash:
de2b5fe8823d87e441417c4db5efb4a1078c7f11
Detections:
win_unidentified_045_g0
Create hunting rule
win_unidentified_045_auto
Create hunting rule
Link:
https://www.unpac.me/results/b30ed312-5760-43d9-b692-0fda4a4e13f3/
SH256 hash:
3b94c004400a661beb0b5cc13b56f842e1b9ee069638107d152e46585f32cc29
MD5 hash:
6142203417fef3a24db55aa67e09b50b
SHA1 hash:
d7d1f1ae927814d4789d2bd4162dfe152a97622a
Link:
https://www.unpac.me/results/b30ed312-5760-43d9-b692-0fda4a4e13f3/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments