MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f8c2498827bb9d8f9bb7f4afa1ce404359702bcbc98d76e39a4dfec09eddb27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f8c2498827bb9d8f9bb7f4afa1ce404359702bcbc98d76e39a4dfec09eddb27
SHA3-384 hash: d9e038ab39f998273c7667022cda30425c90a9acf2479d530a42e575496af1639aaf9a320c2c554a9c982531240e2e53
SHA1 hash: f4d67a566ff96b3001d00c9eead9ae841205f382
MD5 hash: ff1799ca2c5738dae6b85f43719a9068
humanhash: quiet-kilo-maine-queen
File name:1f8c2498827bb9d8f9bb7f4afa1ce404359702bcbc98d76e39a4dfec09eddb27
Download: download sample
File size:1'281'120 bytes
First seen:2020-11-07 20:03:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 24576:JanwhSe11QSONCpGJCjETPlnXWZ5PbcmC3f/DFNkTF8t2oplIS95:knw9oUUEEDlG7jcmWH/IcIS95
Threatray 108 similar samples on MalwareBazaar
TLSH 15552371193EB9DAC378113C10A61D00469E8B95945C6E72F3F332C75F7ABAD2D6A01E
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Eati-7331386-0
Create hunting rule

Win.Malware.Eati-7331431-0
Create hunting rule

Win.Malware.Eati-7331499-0
Create hunting rule

Win.Malware.Eati-7331637-0
Create hunting rule

Win.Malware.Eati-7331642-0
Create hunting rule

Win.Malware.Eati-7332809-0
Create hunting rule

Win.Trojan.Mansabo-9670631-0
Create hunting rule

Win.Trojan.Mansabo-9787656-0
Create hunting rule

Win.Trojan.Mansabo-9787658-0
Create hunting rule

Win.Trojan.Mansabo-9787665-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the system32 directory
Creating a process from a recently created file
Creating a window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f8c2498827bb9d8f9bb7f4afa1ce404359702bcbc98d76e39a4dfec09eddb27/
Gathering data
Verdict:
malicious
Similar samples:
13667895d952d43a44d7b2bb57abdd637668c236c39a96d73db6abac2f7ae56d
1d7d407373486969a62a5065b100778cf372553887d5b86277994cb927883317
1f39a2d168cf2fe25fddc7ff3026e356f1f81cc8bdf11d57051b991fe8985b2c
2c9df010eb7c37323ed6b2ee6e23078e80055ce35da1ac9c0bf4ea7d2bd5a334
6cf3484104978078ce2b68aa4e090de13b7c8321e0a9bc41b1d6c7e71bc6a20d
78fdd76fe0ced61ba5857bd5283413d5e5d70d7a01330a815737cf9bd7cfea6d
9504b3b1cf0c21196ec76fc281c2fbc82a183fedfa49c203fa9f2b5d4477a255
c7f0b6c44c3be1a3b6d3c33aa0fa9ecd31b6972a0eecd9fa2a1f55d13f78151d
d3bd296a41eb538aa699d56bb4140be622d57746d06702cf044fc46ba911462c
fe6a6de7774c915bb7277284d3afe97ed7370ee4f4ad7060ebff866eecdb4fd1
+ 98 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201108-wnm4vcjf52/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments