MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e6131270a54d52eff9606baa7503abf3ba8b20f268f99dd2657f750532e9396. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e6131270a54d52eff9606baa7503abf3ba8b20f268f99dd2657f750532e9396
SHA3-384 hash: 8266aee830a5c0d8d02b774fa239d94f6261081788b5cb08ac5fa5a9ae71f52269c48cc573a706572e82a399c72c65b6
SHA1 hash: fda61a5ac85cdce01d7d22d6177288932f697293
MD5 hash: fb21e7f365b3e5c63dd1cd0a01c50953
humanhash: social-oregon-seventeen-pennsylvania
File name:03_extracted.dll
Download: download sample
File size:10'240 bytes
First seen:2021-09-02 12:55:21 UTC
Last seen:2021-09-04 21:29:03 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 96:7g4fgGsTk7rHzQ/hynMNnFGwqha/qvvvvGfplqlpsW3qe0lMsYsGY7+Mhdc:zfbyk7HWfvhqT3AusYjMg
Threatray 3 similar samples on MalwareBazaar
TLSH T156229400E7D489A3CFEE4FBC89A3034047B6F586CB07D79F154659643F477A209A4E99
Reporter Racco42
Tags:dll

Intelligence

File Origin
# of uploads :
3
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/184760/
Detection(s):
SecuriteInfo.com.MSIL.Injector.UWS.7501.14179.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Malware family:
HCrypt
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ea2d687a-88b8-4621-8a6a-da8c4363ffda
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/843989
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e6131270a54d52eff9606baa7503abf3ba8b20f268f99dd2657f750532e9396/
Threat name:
ByteCode-MSIL.Trojan.InjectorX
Create hunting rule
Status:
Malicious
First seen:
2021-08-21 13:26:39 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
1aca49752cef2bb58d097e0ac96963e32f14e4e6b1e6e24e11125d1e9ef54cf2
4bf1e0d167fa92e2cf62e30e5b454277d85874628fdb7de79bcd368393c12bc6
c991fe8c6d840624fbf7b46c88514ff6324fea56997929b0a81d97b0f6eb7f88
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210902-hmjmll2cs6/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
1e6131270a54d52eff9606baa7503abf3ba8b20f268f99dd2657f750532e9396
MD5 hash:
fb21e7f365b3e5c63dd1cd0a01c50953
SHA1 hash:
fda61a5ac85cdce01d7d22d6177288932f697293
Link:
https://www.unpac.me/results/28100fa1-e53e-4873-b847-72fff829da1d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/1e6131270a54d52eff9606baa7503abf3ba8b20f268f99dd2657f750532e9396

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/184760/

Comments