MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b
SHA3-384 hash: 3c86ea7103ef7d56fdf7af2179979f455cc5aedaa4b3754b01a5f4cfb4612da24bfed77045161ab334bf0995b6410fb0
SHA1 hash: bcf4ffa92efac170177e5b8f9199bd8cf8c8d380
MD5 hash: e3bc953a18fe466cb008184a45c6c858
humanhash: angel-minnesota-neptune-golf
File name:20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b
Download: download sample
File size:69'456 bytes
First seen:2020-11-24 12:47:15 UTC
Last seen:2020-11-25 06:37:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fe6a9a7cf52c54a3771d23895e7f6432
ssdeep 768:l/vKEKgGO4eho4uIeBYQdCOsdx4JyN6F4G+EDICn0XimuaEje55voslL2hjvdwpl:l/vlKs4UO24rdYEQ5RlLCjFwpl
Threatray 11 similar samples on MalwareBazaar
TLSH 50638D12F5919432D5736A745AF4C2B54ABA7A015BB0C2DB33940D688FB23D0DE38B3B
Reporter JAMESWT_WT
Tags:Insta Software Solution Inc. KILLAV signed

Code Signing Certificate

Organisation:AAA Certificate Services
Issuer:AAA Certificate Services
Algorithm:sha1WithRSAEncryption
Valid from:Jan 1 00:00:00 2004 GMT
Valid to:Dec 31 23:59:59 2028 GMT
Serial number: 01
Intelligence: 384 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/545993
Signature
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
Uses cmd line tools excessively to alter registry or file data
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 322093 Sample: sHQpHtfu5s Startdate: 24/11/2020 Architecture: WINDOWS Score: 68 40 Antivirus / Scanner detection for submitted sample 2->40 42 Multi AV Scanner detection for submitted file 2->42 8 sHQpHtfu5s.exe 1 2->8         started        process3 signatures4 44 Detected unpacking (changes PE section rights) 8->44 11 cmd.exe 1 8->11         started        14 cmd.exe 1 8->14         started        16 cmd.exe 1 8->16         started        18 6 other processes 8->18 process5 signatures6 46 Uses cmd line tools excessively to alter registry or file data 11->46 20 conhost.exe 11->20         started        22 reg.exe 1 11->22         started        24 conhost.exe 14->24         started        26 reg.exe 1 14->26         started        34 2 other processes 16->34 28 conhost.exe 18->28         started        30 conhost.exe 18->30         started        32 conhost.exe 18->32         started        36 2 other processes 18->36 process7 process8 38 conhost.exe 28->38         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-06 00:20:40 UTC
File Type:
PE (Exe)
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
30dcc7a8ae98e52ee5547379048ca1fc90925e09a2a81c055021ba225c1d064c
389e03b1a1fd1c527d48df74d3c26a0483a5b105f36841193172f1ee80e62c1b
3d94c4a92382c5c45062d8ea0517be4011be8ba42e9c9a614a99327d0ebdf05b
68eb2d2d7866775d6bf106a914281491d23769a9eda88fc078328150b8432bb3
6a15e26804644d8c13c19260e449186899050e513b6be6ae5ef65ed799906dca
94b76ce34e5493bb59586b41f41b23baa07a55f2397e80775573714b1311103c
b4afc259d1032bf4ac6db0092d7b364fb11458a4c2100aa2606df6d81e5d5122
b61d3d1fbd98a10bd0f050173ca38941fb11b859872894b88bca7cfdd5cd2597
b670441066ff868d06c682e5167b9dbc85b5323f3acfbbc044cabc0e5a594186
ccf93828e1b44a75820989d72a2c019ae3b0a98944bf9eb1884e77f16050c53f
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion trojan
Link:
https://tria.ge/reports/201124-37f4qzxpx6/
Behaviour
Suspicious use of WriteProcessMemory
Modifies Windows Defender Real-time Protection settings
Unpacked files
SH256 hash:
20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b
MD5 hash:
e3bc953a18fe466cb008184a45c6c858
SHA1 hash:
bcf4ffa92efac170177e5b8f9199bd8cf8c8d380
Link:
https://www.unpac.me/results/02eb31ea-6ba4-4c91-ac78-218a56408202/
SH256 hash:
721deeff99567c0baa0cf3acbc9ef5c0d66a2eff5993a7f73b81fcbfa5238b3e
MD5 hash:
9d458b6835ea58e12d7e17b61fe6609b
SHA1 hash:
5bf2734a723cfcd9a1d08e241af6528d8bc1fdf6
Link:
https://www.unpac.me/results/02eb31ea-6ba4-4c91-ac78-218a56408202/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Hupigeon
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments