MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e91acd014a0dcf929f9beb50120526bcf3511c014afe065f9f6a3d79907e536. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e91acd014a0dcf929f9beb50120526bcf3511c014afe065f9f6a3d79907e536
SHA3-384 hash: 514cdf0643e25892fdee6dc232d034756502b80341295a6ff27c9a7e6fe0d241eb853cbe9c00d9a759ad335ff20fd95f
SHA1 hash: 6810d397acec0e03d4ac2743ff460fca272a9142
MD5 hash: 03ad5f7ddfe063bcc609131c3ad27558
humanhash: illinois-seventeen-beryllium-early
File name:1e91acd014a0dcf929f9beb50120526bcf3511c014afe065f9f6a3d79907e536
Download: download sample
File size:1'447'341 bytes
First seen:2020-11-07 18:30:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 24576:JanwhSe11QSONCpGJCjETPlrXWZ5Pbcq92zjP+sjI1XPl9f1XsmIh:knw9oUUEEDli7jcq4nPUjfx6
Threatray 115 similar samples on MalwareBazaar
TLSH D56533158B2C79CBC7B8167C04461F4C81B6C989E44CA9F8E3AAB6C36FBC7795E6500D
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Eati-7331386-0
Create hunting rule

Win.Malware.Eati-7331431-0
Create hunting rule

Win.Malware.Eati-7331499-0
Create hunting rule

Win.Malware.Eati-7331637-0
Create hunting rule

Win.Malware.Eati-7331642-0
Create hunting rule

Win.Malware.Eati-7332809-0
Create hunting rule

Win.Trojan.Mansabo-9670631-0
Create hunting rule

Win.Trojan.Mansabo-9787656-0
Create hunting rule

Win.Trojan.Mansabo-9787658-0
Create hunting rule

Win.Trojan.Mansabo-9787665-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the system32 directory
Creating a process from a recently created file
Creating a window
Result
Verdict:
MALICIOUS
Details
Base64 Encoded Powershell Directives
Detected one or more base64 encoded Powershell directives.
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e91acd014a0dcf929f9beb50120526bcf3511c014afe065f9f6a3d79907e536/
Gathering data
Verdict:
malicious
Similar samples:
13667895d952d43a44d7b2bb57abdd637668c236c39a96d73db6abac2f7ae56d
4ce055b35b84b19a42d0335538abcac50b4ce66736deed366932e39fbfeaf50c
54a7d9ced364000bd8d7bd0e8d25959428caf0f16c867e0a6c0e78174f22d22f
5f65d54f0742f88bf599dad175a5f5674e64dd76a3e8ce06f68b0e83574f2fa3
68dc7c7dfdac09078ca6c904bedaa8975a5c1f06390dfdffffed453d75474014
919269592bd17fee63c08a140bc5c9dc18daf21f4c3afb27716aad0b71fd4cf4
a85e547f74ef5452bae6e79a5004c73a604e6d3febbe1c85fae1a65d39a97f2d
c7f0b6c44c3be1a3b6d3c33aa0fa9ecd31b6972a0eecd9fa2a1f55d13f78151d
ddd1ffbec2f733c514c08f75d02302f30e69f7295a109e1361087c4ac36f9ab6
fe6a6de7774c915bb7277284d3afe97ed7370ee4f4ad7060ebff866eecdb4fd1
+ 105 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201108-8mzwnbte7a/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments