MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24a163dbbbd12e458bcbcfa3e9707da5c7364369060344f062ef46dbf208169d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24a163dbbbd12e458bcbcfa3e9707da5c7364369060344f062ef46dbf208169d
SHA3-384 hash: da0f587b2492fdfb0d42cf1db1c0afa5edd023b6b79082ff289d48c6c30960789e0631377bcaa1c7a524a091dae04dee
SHA1 hash: d43d471b3ba5a29edb0910ac5b8db6ce079fece2
MD5 hash: 08684a98326e5e871ee7832859ff16da
humanhash: eighteen-july-jig-idaho
File name:1.exe
Download: download sample
File size:3'460'144 bytes
First seen:2021-07-17 07:10:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5877688b4859ffd051f6be3b8e0cd533 (119 x Babadeda, 2 x DCRat, 2 x RedLineStealer)
ssdeep 98304:cT2p3Q2zMofa6e2BLTQscZJziK0OFEt4:cT03Q8S0TQrZRiK3
Threatray 62 similar samples on MalwareBazaar
TLSH T1C7F53346F2EE3AEAD1E310771D74713A62750EB58782DDB3C3097491C2396C6C13A6BA
Reporter LittleRedBean2
Tags:exe Ransomware Skidware

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1.exe
Verdict:
No threats detected
Analysis date:
2021-07-17 07:12:54 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c4a406ed-6214-4201-b514-c6ca32caff31

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172313/
Detection(s):
PUA.Win.Packer.Purebasic-2
Create hunting rule

SecuriteInfo.com.BAT.KillWin.dropper.1184.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4b2bb646-592c-4409-b00f-d98b810d99e1
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/817782
Signature
Creates an autostart registry key pointing to binary in C:\Windows
Detected unpacking (overwrites its own PE header)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 450193 Sample: 1.exe Startdate: 17/07/2021 Architecture: WINDOWS Score: 76 60 Multi AV Scanner detection for dropped file 2->60 62 Multi AV Scanner detection for submitted file 2->62 8 1.exe 11 2->8         started        process3 file4 38 C:\Users\user\AppData\Local\Temp\...\9M1B.TMP, PE32 8->38 dropped 40 C:\Users\user\AppData\Local\Temp\...\5HB2.TMP, PE32 8->40 dropped 42 C:\Users\user\AppData\Local\...\miniworld.exe, PE32 8->42 dropped 64 Detected unpacking (overwrites its own PE header) 8->64 12 cmd.exe 4 8->12         started        signatures5 process6 file7 44 C:\Users\user\AppData\Roaming\...\9M1B.TMP, PE32 12->44 dropped 46 C:\Windows\System32\msfdhs.exe, PE32 12->46 dropped 66 Uses ping.exe to sleep 12->66 68 Uses ping.exe to check the status of other devices and networks 12->68 16 reg.exe 1 1 12->16         started        19 PING.EXE 1 12->19         started        22 miniworld.exe 6 56 12->22         started        25 conhost.exe 12->25         started        signatures8 process9 dnsIp10 58 Creates an autostart registry key pointing to binary in C:\Windows 16->58 48 127.0.0.1 unknown unknown 19->48 50 192.168.2.1 unknown unknown 19->50 30 C:\Users\user\AppData\Roaming\...\uninst.exe, PE32 22->30 dropped 32 C:\Users\user\AppData\Roaming\...\start.mnw, PE32 22->32 dropped 34 C:\Users\user\AppData\Roaming\...\msvcr90.dll, PE32 22->34 dropped 36 5 other files (none is malicious) 22->36 dropped 27 MicroMiniNew.exe 6 22->27         started        file11 signatures12 process13 dnsIp14 52 operate.mini1.cn 134.175.65.176, 49714, 80 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa China 27->52 54 mdownload.mini1.cn 27->54 56 4cfdbd9f.cdn.ucloud.com.cn 27->56
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24a163dbbbd12e458bcbcfa3e9707da5c7364369060344f062ef46dbf208169d/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-07-17 07:11:05 UTC
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
12db6f77d235f0af6461a490040f23e1dc902385de317cd19b5478df425f2ec0
1f79ce7d7716512af2a93caf014f302846d5f41ff9850af71120c7fed2bf5845
504ff4e37ac526cdb49cca15b1b769cf152889ba32fe9440e16974505d885130
7570a7a6830ade05dcf862d5862f12f12445dbd3c0ad7433d90872849e11c267
83946c44e144416c6c321a02db9482c7de37073f1a1814a5525504794af402bc
98e3304a43402227458a979aad31e2ec1543c0c5d58c118d0a8fa8c70cc78d74
a3d17643b5a0f0c03a63122ee0543526b2928baa55c280580e7f20fc202bd24d
c1eb88cc7f7b43de1ef71fae416c729483d71fa930314c36dfb03b01b8455d31
ceddcfa72226e91f7435facafe6631d1385ca4d246d242d5136ac4e9462b8611
de7e679cc16da78f63136976deda7c04ca9fc86f31f16989c5e2385011546034
+ 52 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig discovery miner persistence ransomware upx
Link:
https://tria.ge/reports/210717-ywr38ydx1s/
Behaviour
Checks SCSI registry key(s)
Delays execution with timeout.exe
Enumerates processes with tasklist
Enumerates system info in registry
Kills process with taskkill
Modifies registry class
Modifies registry key
Runs ping.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
NSIS installer
Enumerates physical storage devices
Drops file in System32 directory
Adds Run key to start application
Checks installed software on the system
Enumerates connected drives
Loads dropped DLL
Executes dropped EXE
Modifies Installed Components in the registry
Modifies extensions of user files
UPX packed file
xmrig
Unpacked files
SH256 hash:
f13c0e82cb212596c8585646a201ce77a3722ff535485c66d5f5b3ab7254e32a
MD5 hash:
312a869d844ace78aa498d4535b3885c
SHA1 hash:
d0ebc91a37802ec1ab64637297b9c42646ef79ba
Link:
https://www.unpac.me/results/765c8a93-df0c-4f53-9eae-cb63a67346c4/
SH256 hash:
7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
MD5 hash:
a4173b381625f9f12aadb4e1cdaefdb8
SHA1 hash:
cf1680c2bc970d5675adbf5e89292a97e6724713
Link:
https://www.unpac.me/results/765c8a93-df0c-4f53-9eae-cb63a67346c4/
SH256 hash:
ba6cd4d4d28b7d96c10ad69702169988f2b84038d14cab0ea3bd02b154e7cf65
MD5 hash:
98b9e78d7462d77ba986cc4ebbbed2bd
SHA1 hash:
a99ae79e84fa29cdafa89ffcaabad4d88ce08c98
Link:
https://www.unpac.me/results/765c8a93-df0c-4f53-9eae-cb63a67346c4/
SH256 hash:
ba67eb0048597d442d94294fce3fb27e7917705e4722862cb01426d8dbbddec1
MD5 hash:
447246c2b21fab056653c0845d81f983
SHA1 hash:
9747e6e6589c14d6b40615d9751bad763a2f6822
Link:
https://www.unpac.me/results/765c8a93-df0c-4f53-9eae-cb63a67346c4/
SH256 hash:
4f79dfa9de21473b0be6113824e7174b7e99917aaa269248a8e3e9a3d4a44014
MD5 hash:
f811aa9b17dcb5a409993c69b8da6ced
SHA1 hash:
4c31a278b02d32a46b3d25ab784d97396f1deea1
Link:
https://www.unpac.me/results/765c8a93-df0c-4f53-9eae-cb63a67346c4/
SH256 hash:
f46016a0ab676ceaf209333c1a3c4ad3012cd1e08f62ab3f7a1c08cea577fb3b
MD5 hash:
4cb1bc18447c333ce6a38d50de27312e
SHA1 hash:
3759aca3d4c9c3a6062c5a2af9f139e69db119c7
Link:
https://www.unpac.me/results/765c8a93-df0c-4f53-9eae-cb63a67346c4/
SH256 hash:
c42ae26d55033edf571dd270bd3ead313058473412fdc482a3528e5ba410cc69
MD5 hash:
c94fbecf09f4d39465c2c4dce1814f6d
SHA1 hash:
306691ea77e66cb58368701923a17b976ae651e9
Link:
https://www.unpac.me/results/765c8a93-df0c-4f53-9eae-cb63a67346c4/
SH256 hash:
2cc12b331f4e4cceee2caedeae3595c89ed8863966737d9c14280773f5a3ab7c
MD5 hash:
5017ecfb0b4c152de6f848fabebb69a8
SHA1 hash:
2b91a110857a79c9a791baee74ef02ccf5e69852
Link:
https://www.unpac.me/results/765c8a93-df0c-4f53-9eae-cb63a67346c4/
SH256 hash:
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 hash:
325b008aec81e5aaa57096f05d4212b5
SHA1 hash:
27a2d89747a20305b6518438eff5b9f57f7df5c3
Link:
https://www.unpac.me/results/765c8a93-df0c-4f53-9eae-cb63a67346c4/
SH256 hash:
82422e89e772c43a97f7cb89e2b9bd3d3d619ac2a7a510bea3ba2c0fdf5f9d34
MD5 hash:
be7d08cba4c266cd5f7713a7da6cf3f6
SHA1 hash:
d9e5f7d83092bcdf87c111e5103e35b973f01940
Link:
https://www.unpac.me/results/765c8a93-df0c-4f53-9eae-cb63a67346c4/
SH256 hash:
24a163dbbbd12e458bcbcfa3e9707da5c7364369060344f062ef46dbf208169d
MD5 hash:
08684a98326e5e871ee7832859ff16da
SHA1 hash:
d43d471b3ba5a29edb0910ac5b8db6ce079fece2
Link:
https://www.unpac.me/results/765c8a93-df0c-4f53-9eae-cb63a67346c4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/24a163dbbbd12e458bcbcfa3e9707da5c7364369060344f062ef46dbf208169d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/172313/

Comments