MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 12db6f77d235f0af6461a490040f23e1dc902385de317cd19b5478df425f2ec0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 12db6f77d235f0af6461a490040f23e1dc902385de317cd19b5478df425f2ec0 |
|---|---|
| SHA3-384 hash: | c2f5cbf67a9bdeb5de2c7c4bc63a28024aa12c2b9a554773b8a8cec715718807c6b0dc2c6cc694616bc2d5953a38ca94 |
| SHA1 hash: | 609f491429520427dd4b8034ea0f313481e19b43 |
| MD5 hash: | b6ccb153be2baeb540e487cf5d52ee0b |
| humanhash: | jersey-wisconsin-oscar-nine |
| File name: | SuperEnjoy.exe |
| Download: | download sample |
| File size: | 1'051'648 bytes |
| First seen: | 2021-02-06 20:34:16 UTC |
| Last seen: | 2021-02-06 20:34:28 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5877688b4859ffd051f6be3b8e0cd533 (119 x Babadeda, 2 x DCRat, 2 x RedLineStealer) |
| ssdeep | 24576:KTTsFdCYHmXIz2MYLjtAuiy6vNr7r688ZQ:cTuHPz2MYYyu1SQ |
| Threatray | 242 similar samples on MalwareBazaar |
| TLSH | 6D25E1FA77AA0295F8619833D855C1FA1603CF9443B1E69607CDFC1BB40A6738B5B22D |
| Reporter | Anonymous |
| Tags: | filecoder Ransomware |
Anonymous
Batch Filecoder, sends the password through a Webhook and "create" a fake bitcoin account, copy itself in startup menu, haves random version info like please openme or new realistic software.Intelligence
File Origin
# of uploads :
2
# of downloads :
228
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
12db6f77d235f0af6461a490040f23e1dc902385de317cd19b5478df425f2ec0.zip
Verdict:
Malicious activity
Analysis date:
2021-02-07 07:06:28 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Launching a process
Enabling the 'hidden' option for analyzed file
Creating a process from a recently created file
Creating a window
DNS request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Searching for the window
Creating a file
Launching cmd.exe command interpreter
Enabling the 'hidden' option for recently created files
Sending a UDP request
Launching a tool to kill processes
Forced shutdown of a system process
Forced shutdown of a browser
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Signature
Binary is likely a compiled AutoIt script file
Creates files in the system32 config directory
Detected unpacking (overwrites its own PE header)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Threat name:
Win32.Ransomware.FileCoder
Status:
Malicious
First seen:
2021-02-06 20:35:07 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 232 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
evasion ransomware spyware
Behaviour
Creates scheduled task(s)
Kills process with taskkill
Modifies Internet Explorer settings
Modifies registry class
Script User-Agent
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Reads user/profile data of web browsers
Executes dropped EXE
Sets file to hidden
Unpacked files
SH256 hash:
b116ff00546620a598119d6704e9849393d2f9948fc8888d6ddf6211aa5b80b9
MD5 hash:
fb7a78f485ec2586c54d60d293dd5352
SHA1 hash:
d4e1f1061f7a872f9843e44c7d27d13ba7ef71bb
SH256 hash:
993c755e43045f98e4975a8ae1e11996af3717507dc21d88a2a81b79fd121fe2
MD5 hash:
9920cf73e80fbf318b357ddbacfe2484
SHA1 hash:
ff94269e0ae8a7099f2b65dd7b1d3279a9b0a514
SH256 hash:
64fd57fa497a3fd43de4f84b4bba41e423823c8db7ca57d9ef2cdd0617c7bf1b
MD5 hash:
606f03eb43edd0ae7f75538c27fa907a
SHA1 hash:
92d75e20809c73a9e69c5ced88e76084eebcffb0
SH256 hash:
266949ac2768ba4e7da0f94077d286a08475d2a332b9b777d570b6c3d6c83bf8
MD5 hash:
4d2ee4f942536f411b5ddc9d0b8171f5
SHA1 hash:
6945096f72094b315e6be0a999850939448ee021
SH256 hash:
2eadd6c8ed9fb4ac46c493f98b1b46d12338301230e2880125cec645dc514cd2
MD5 hash:
909c3f37a0d1740b9ab3f61e89d0b12b
SHA1 hash:
468cdb39977dc9da5bcb76b9f749b5b83c8fcb62
SH256 hash:
ad80064f71d273967dcf0b14b9cd6e84d79a132231d619687d9266c7807bdfe0
MD5 hash:
a35ee23aaab26afc575ac83df9572b57
SHA1 hash:
81ea38c694ce9702faddfb961f17c1bbf628a76d
SH256 hash:
e37aa72bca3cecb9bdbe51cbd81ec1143bb17163088a1379a4ccb93f5d881e76
MD5 hash:
5cac4fe734fc8454ccb847e030beee38
SHA1 hash:
34298fe220e35f614b2c837cf1dc2604ab0882d6
SH256 hash:
12db6f77d235f0af6461a490040f23e1dc902385de317cd19b5478df425f2ec0
MD5 hash:
b6ccb153be2baeb540e487cf5d52ee0b
SHA1 hash:
609f491429520427dd4b8034ea0f313481e19b43
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
CoinMiner
Score:
0.60
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 12db6f77d235f0af6461a490040f23e1dc902385de317cd19b5478df425f2ec0
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.