MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28006c46a4b5be075add55f0c3d152f0d222f6af26b69e8d1295bc1be363c4df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28006c46a4b5be075add55f0c3d152f0d222f6af26b69e8d1295bc1be363c4df
SHA3-384 hash: c5280b8eb52d690fc0bfb2133a836f3cf00ec881d60d3099fbb536e5ffd2f99b2f03c366e768551831bc775c4edb850c
SHA1 hash: 9e2c91cba0daff143b1049ca8d86e013cb9c217e
MD5 hash: 1a6a16e4a7ea0f0380bad1844993c11e
humanhash: oxygen-montana-colorado-robin
File name:78b12ae14b74887180242a5fedc2b17115419fc26e62283256d859adf2c7e023.bin
Download: download sample
File size:863'744 bytes
First seen:2020-07-01 09:37:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5688b19b58c75a0462a77240ace49a5e (3 x njrat, 1 x CryptoDarkRubix)
ssdeep 24576:Z4ba93ww33sZLEE+PDk+BWmAlgV9+Fptx:SbjwHyqKx
Threatray 14 similar samples on MalwareBazaar
TLSH 2105F125FAD08937C1732B3C8DE6D1640829BBA12D2868477BEC4D08DF3B7567926397
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/18154/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28006c46a4b5be075add55f0c3d152f0d222f6af26b69e8d1295bc1be363c4df/
Threat name:
Win32.Ransomware.Higuniel
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 09:39:05 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
5b5eab7a12fdfc6cc39e39193b7a9020ee46e72acac70033236ef9b6b2da32c7
70d86fc8d1247dcd26ed0927411614973d45216d676978f768e14cb16d362536
70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21
991c4166a2246ca5ae9186a1e747f5eb767fdbd304dbfa1c5f4a2019cb6b4aec
9e6c0d4f163023b3f001d49cf313e8cce5e03cab40685d4f5f6212696f05f470
ab5290082addf7d5c9151647adfd31428c713aafa76f9e8bcb5aa609abd3dbef
aeb1bfcef382789091e72e2d6cae6e471123d0e8e7a5f39c64abf5a3d9a4eaa8
af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a
e3bb8c334350185803b3863f71d6fced186b373e8768bb537e371dff11f74386
f4901daf97516f9a9b54233dd81810398de07db40d47072f37d90b4225387fd2
+ 4 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/200701-fck9dflz8x/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Program crash
Maps connected drives based on registry
Maps connected drives based on registry
Checks BIOS information in registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Looks for VirtualBox Guest Additions in registry
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Unknown_PWDumper_Apr18_3
Create hunting rule
Author:Florian Roth
Description:Detects sample from unknown sample set - IL origin
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/18154/

Comments