MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 250c1dda429b8b2c8b638ddc80999039267bda7b959d5a854c5f4855601df548. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 250c1dda429b8b2c8b638ddc80999039267bda7b959d5a854c5f4855601df548
SHA3-384 hash: 3a23b5fd8baf40b0903de4d963ce0d7601e679a6900c07126dd68725daf4397e322773ea18f8e9f41b3cb2bda64f53fa
SHA1 hash: c22a8b66f860c3e67badac542209b50abb776cc4
MD5 hash: ec9e38bb960441b3efa806dd586d1eba
humanhash: mockingbird-arkansas-comet-solar
File name:ec9e38bb960441b3efa806dd586d1eba.exe
Download: download sample
File size:393'728 bytes
First seen:2021-08-14 06:59:10 UTC
Last seen:2021-08-14 07:57:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b09961d8006e7ff4bbe247dfce906b36 (5 x RaccoonStealer, 3 x RedLineStealer, 2 x Smoke Loader)
ssdeep 6144:TLU9u4p8y9C6YjEStb7UauFjy4Qu64xKGzRtB14+4OROBBoCi:TA9u4uyA6EDkauFjl64xJ1WO+Bi
Threatray 4'445 similar samples on MalwareBazaar
TLSH T16884E0C1B5B3D87EC495D4F004248BB4AB7DB8516A08050FA79A2F2A6E331A395FE3D5
dhash icon 4839b2b0e8c38890 (105 x RaccoonStealer, 38 x Smoke Loader, 33 x RedLineStealer)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ec9e38bb960441b3efa806dd586d1eba.exe
Verdict:
Malicious activity
Analysis date:
2021-08-14 07:02:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/168357d8-4f67-4488-9b18-63759d45b10b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/179178/
Detection(s):
SecuriteInfo.com.Variant.Babar.28032.4872.30580.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/71a2de31-df43-4a7e-904b-a2b3e1c6c02e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/832807
Signature
Contains VNC / remote desktop functionality (version string found)
Creates a thread in another existing process (thread injection)
Creates autostart registry keys with suspicious names
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 465239 Sample: k2evNDwHoj.exe Startdate: 14/08/2021 Architecture: WINDOWS Score: 100 49 ebanat6977769.com 2->49 59 Multi AV Scanner detection for submitted file 2->59 61 Machine Learning detection for sample 2->61 63 Contains VNC / remote desktop functionality (version string found) 2->63 65 4 other signatures 2->65 8 k2evNDwHoj.exe 2 4 2->8         started        12 33A2E4F0.exe 2->12         started        14 33A2E4F0.exe 2->14         started        signatures3 process4 file5 43 C:\ProgramData\...\33A2E4F0.exe, PE32 8->43 dropped 67 Detected unpacking (changes PE section rights) 8->67 69 Detected unpacking (overwrites its own PE header) 8->69 71 Creates autostart registry keys with suspicious names 8->71 16 33A2E4F0.exe 8->16         started        signatures6 process7 dnsIp8 45 ebanat6977769.com 45.156.24.116, 49772, 80 CLOUDBACKBONERU Russian Federation 16->45 47 192.168.2.1 unknown unknown 16->47 51 Multi AV Scanner detection for dropped file 16->51 53 Detected unpacking (changes PE section rights) 16->53 55 Detected unpacking (overwrites its own PE header) 16->55 57 4 other signatures 16->57 20 WerFault.exe 9 16->20         started        23 WerFault.exe 9 16->23         started        25 WerFault.exe 9 16->25         started        27 4 other processes 16->27 signatures9 process10 file11 29 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 20->29 dropped 31 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 23->31 dropped 33 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 25->33 dropped 35 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 27->35 dropped 37 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 27->37 dropped 39 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 27->39 dropped 41 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 27->41 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/250c1dda429b8b2c8b638ddc80999039267bda7b959d5a854c5f4855601df548/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-08-14 01:54:23 UTC
AV detection:
24 of 46 (52.17%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0f8024be3da4951480fa2fc6459426d7a4b0d9f46ec8fcbb04a3b8ccfca674d0
2e3b767101904dd4352ece4ac162a9253edc02609db93ef70801e3a6fe1268f4
596e82d24c64a373095159ee769df582d6f34fde24eb537aca442d8f01c491db
5d7bc178cb3eafae7b2c99b2cfd2ceec87119cf2403f86af87435d4479f36724
786b9cb2fa5e78e4bc0d9e67e6f90c0229b150bacfd3e75cf46a9c3a67d57a67
9f1c935d143a59d2429f2681007c61ee07504302e5798d7abdb9a5d44d90e13b
a8e2a996c913eb390bd0074d461a97156ad7395ae5ca856c2a6e6c14be534e2d
c9052a72f8d94fabf633aa750a1f7dbf0f211ef4be463443d2d064ffa8bb79d7
cceb5da1ebba042d949f4afef5f5e4638826493201564245be0448920dac639c
+ 4'435 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/210814-edjbnbapdn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
8fe1877b2cb312eaa3b1fd4b10bcd9c4050a86f55b602704db3a6a453ff0e7a8
MD5 hash:
2ec55de670faf40bbce8624884512519
SHA1 hash:
de87552e3af4bd3f9cd7baa93b652fc21c60b952
Link:
https://www.unpac.me/results/6a67fd39-bd41-4666-a9bc-d8a3d48cbfa2/
SH256 hash:
250c1dda429b8b2c8b638ddc80999039267bda7b959d5a854c5f4855601df548
MD5 hash:
ec9e38bb960441b3efa806dd586d1eba
SHA1 hash:
c22a8b66f860c3e67badac542209b50abb776cc4
Link:
https://www.unpac.me/results/6a67fd39-bd41-4666-a9bc-d8a3d48cbfa2/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/250c1dda429b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/250c1dda429b8b2c8b638ddc80999039267bda7b959d5a854c5f4855601df548

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 250c1dda429b8b2c8b638ddc80999039267bda7b959d5a854c5f4855601df548

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/179178/
  
URLhaus
https://urlhaus.abuse.ch/url/1525649/
  
Delivery method
Distributed via web download

Comments