MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f39a2d168cf2fe25fddc7ff3026e356f1f81cc8bdf11d57051b991fe8985b2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f39a2d168cf2fe25fddc7ff3026e356f1f81cc8bdf11d57051b991fe8985b2c
SHA3-384 hash: 429627b68296db46f7849f728b32118ac00be38bba44a3204edd20aacb59f5d506df41b581dc6e159b76e7db57b0900d
SHA1 hash: d08a7227939dc0028fb1349061f5c818d456d504
MD5 hash: d9661c38667ad6d5f65da3ac715ef1d5
humanhash: enemy-bluebird-tennessee-november
File name:1f39a2d168cf2fe25fddc7ff3026e356f1f81cc8bdf11d57051b991fe8985b2c
Download: download sample
File size:960'063 bytes
First seen:2020-11-07 18:59:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 24576:JanwhSe11QSONCpGJCjETPlAMe7bPMS8Ykgcm:knw9oUUEEDlAxTMS8Tgb
Threatray 110 similar samples on MalwareBazaar
TLSH 0D1523520F2B65B7C77E223C148A1A40842163E9D80D7B34E7D761639FF9BE56DBA00E
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Eati-7331386-0
Create hunting rule

Win.Malware.Eati-7331431-0
Create hunting rule

Win.Malware.Eati-7331499-0
Create hunting rule

Win.Trojan.Mansabo-9670631-0
Create hunting rule

Win.Trojan.Mansabo-9787656-0
Create hunting rule

Win.Trojan.Mansabo-9787658-0
Create hunting rule

Win.Trojan.Mansabo-9787665-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the system32 directory
Creating a process from a recently created file
Sending a UDP request
Creating a window
Result
Verdict:
MALICIOUS
Details
Base64 Encoded Powershell Directives
Detected one or more base64 encoded Powershell directives.
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f39a2d168cf2fe25fddc7ff3026e356f1f81cc8bdf11d57051b991fe8985b2c/
Gathering data
Verdict:
malicious
Similar samples:
133947fe94bf9236f7ca7cdab497fdec0c0a6ba81f85b249608eb80dde4ba30f
1e91acd014a0dcf929f9beb50120526bcf3511c014afe065f9f6a3d79907e536
1fea4184fd49bc45c6f69a0dcf92439214b19ecf9f7c4ccfdf6b250f923989b3
2c3976f92e475e102d50542d4b72b4954522f2ca454fe8f23911000ea6ecc1b4
2c9df010eb7c37323ed6b2ee6e23078e80055ce35da1ac9c0bf4ea7d2bd5a334
418cc6f42a9c585548d8f02ca7c605723b657172483b904c35ccd69a8bf62c6c
5f65d54f0742f88bf599dad175a5f5674e64dd76a3e8ce06f68b0e83574f2fa3
aae534ab518c0dfb1c4bc1210fb6cc0c6cb21dcb144fafba18e4fef47bd0f710
c7f0b6c44c3be1a3b6d3c33aa0fa9ecd31b6972a0eecd9fa2a1f55d13f78151d
ddd1ffbec2f733c514c08f75d02302f30e69f7295a109e1361087c4ac36f9ab6
+ 100 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201108-xq1xhc7jhe/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments