MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f6166d9b707f8610c81b7068962611e25cdef8db665b10343179d82131ef0a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 5 File information Yara Comments

SHA256 hash: 0f6166d9b707f8610c81b7068962611e25cdef8db665b10343179d82131ef0a3
SHA3-384 hash: fa01d972fa255a75982896cb73790c0d3834b3a726cc25358939c7c52a6a2ace113fbe37fe021edaa5d652cc95e55e43
SHA1 hash: db52c58a5791865071b17ec7403b8ac9bb9abb66
MD5 hash: 3af1d421410a6e528c93384a25437956
humanhash: wisconsin-oscar-venus-beryllium
File name:SecuriteInfo.com.Trojan.StartPage1.57542.6255.20970
Download: download sample
Signature n/a
File size:113'152 bytes
First seen:2020-08-01 19:31:21 UTC
Last seen:2020-08-02 07:33:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 1536:l9E4W9s8uagyaMlAhH4urp/Cyz4qEOV/pQn2/fqWvMvRY5VYksoHbY5rWyQfYg08:LW9sVag0MH46lYn2Y5
TLSH 8CB3E62D52A19462C2A17DFE2010AB669BBD8FC2178D05472D73B54F1436C3BEE77A2C
Reporter @SecuriteInfoCom

Intelligence


File Origin
# of uploads :
2
# of downloads :
19
Origin country :
US US
Mail intelligence
No data
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Sending a UDP request
Launching a service
DNS request
Sending a custom TCP request
Creating a window
Connection attempt
Launching the process to interact with network services
Enabling autorun for a service
Changing critical settings of the Internet Explorer browser
Deleting volume shadow copies
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.bank.evad
Score:
64 / 100
Signature
Deletes shadow drive data (may be related to ransomware)
Disables Windows Defender (via service or powershell)
Machine Learning detection for sample
Registers a new ROOT certificate
Sigma detected: Delete shadow copy via WMIC
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 255599 Sample: SecuriteInfo.com.Trojan.Sta... Startdate: 01/08/2020 Architecture: WINDOWS Score: 64 39 Sigma detected: Delete shadow copy via WMIC 2->39 41 Machine Learning detection for sample 2->41 43 Deletes shadow drive data (may be related to ransomware) 2->43 45 2 other signatures 2->45 7 SecuriteInfo.com.Trojan.StartPage1.57542.6255.exe 15 3 2->7         started        process3 dnsIp4 33 231.29.2.0.in-addr.arpa 7->33 35 66.186.100.181, 9000 CLEARWAVE-COMMUNICATIONSUS United States 7->35 37 secdo.box.com 185.235.236.197, 443, 49736 BOXNETUS Germany 7->37 47 Deletes shadow drive data (may be related to ransomware) 7->47 49 Registers a new ROOT certificate 7->49 51 Disables Windows Defender (via service or powershell) 7->51 11 net.exe 1 7->11         started        13 powershell.exe 25 7->13         started        15 WMIC.exe 1 7->15         started        17 3 other processes 7->17 signatures5 process6 process7 19 conhost.exe 11->19         started        21 net1.exe 1 11->21         started        23 conhost.exe 13->23         started        25 conhost.exe 15->25         started        27 conhost.exe 17->27         started        29 conhost.exe 17->29         started        31 conhost.exe 17->31         started       
Threat name:
ByteCode-MSIL.Trojan.DelShad
Status:
Malicious
First seen:
2019-07-01 07:51:29 UTC
AV detection:
19 of 31 (61.29%)
Threat level
  5/5
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Modifies Internet Explorer start page
Runs net.exe
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Interacts with shadow copies
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Runs net.exe
Program crash
Modifies service
Deletes shadow copies
ServiceHost packer
Modifies security service

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments