MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 281de330768f7e2231f3984b2fbac04bf9f7f2b2d4fb3c2f91d6ba2eab8d546c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 281de330768f7e2231f3984b2fbac04bf9f7f2b2d4fb3c2f91d6ba2eab8d546c
SHA3-384 hash: 68ebe8e81ee2f345b8be8ddec22cf68d6b644c747ff5260755828445a1bdfd232001319aa1afe8bb12c6171b5bb63810
SHA1 hash: dcc8dcb2cf8debef05959f09054fab0f2e08b3f8
MD5 hash: e9a389a12256716b394c80a05e6065e0
humanhash: fifteen-avocado-king-sodium
File name:e9a389a12256716b394c80a05e6065e0.exe
Download: download sample
File size:555'008 bytes
First seen:2020-12-28 20:01:40 UTC
Last seen:2020-12-28 21:41:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2144f9c12885542d4a4f22de64e840e1 (26 x RedLineStealer, 24 x Smoke Loader, 13 x RaccoonStealer)
ssdeep 12288:66/FUsPq/zQixfgi2wstbSE5n0f0Aa0nfelCAxPUP:N9EzKifst2ER8aaWlCA50
Threatray 1 similar samples on MalwareBazaar
TLSH 61C4124A0668A4E2EB21DE31735FB6E25C413F620E6126662C1EE5E4043DDCFD1D7A8F
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
175
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e9a389a12256716b394c80a05e6065e0.exe
Verdict:
Malicious activity
Analysis date:
2020-12-28 20:03:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/dcd4fed7-b39f-403c-b45c-af2a1727afaa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/109617/
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Possible injection to a system process
Blocking the Windows Defender launch
Rewriting of the hard drive's master boot record
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/571001
Signature
Contains functionality to infect the boot sector
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/281de330768f7e2231f3984b2fbac04bf9f7f2b2d4fb3c2f91d6ba2eab8d546c/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-28 20:02:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
f69bdd82ca22268d090832707e37b1cae408ba96476843b55feedac11acc6277
Result
Malware family:
n/a
Score:
  8/10
Tags:
bootkit persistence upx
Link:
https://tria.ge/reports/201228-z7mahq4qcn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Writes to the Master Boot Record (MBR)
Unpacked files
SH256 hash:
d82739d77c727a51452e3631fcd64fd6188d21c4793767e6c1bc94978e6920f7
MD5 hash:
a072a5d0ee0bc47800c4984b6f0e42bf
SHA1 hash:
4628649162945686f611fe878c0fbe2b1013f758
Link:
https://www.unpac.me/results/66a4843b-31f5-43d5-a89e-e2808cf6b0c8/
SH256 hash:
cf98c75ab336ef7984818017b906c3ab0d19931373d9e31a94070a590cca24a9
MD5 hash:
3d09e0981adb03816430e02654e2b23e
SHA1 hash:
5245fcf9fa5078d3861fd92b53b5361f63578381
Detections:
win_pitou_auto
Create hunting rule
Link:
https://www.unpac.me/results/66a4843b-31f5-43d5-a89e-e2808cf6b0c8/
Parent samples :
281de330768f7e2231f3984b2fbac04bf9f7f2b2d4fb3c2f91d6ba2eab8d546c
b7de56f8c1d25037dbded37355d0cd8219f68d38683913de1e000c2c50159143
ed545d941919632591e31377799e17181448dc29acb80d9bca885a1995a00057
bb338ad009e5f738ff8e482959c3af1fd0d9d68864e8a5574087d53b427aee76
99ddbc06f3ec84f50661bb88036fd872308af6f5841a9730cc020c5b7467a3c0
cd291b0afa870e36bcd70dfc9c4db4cd0d82ddc5b110bfc0ddd644455174b39a
6feed7d5f7d9776c69963076fdb46de01b8ff9253a84b9e086e0beefc85a181d
SH256 hash:
281de330768f7e2231f3984b2fbac04bf9f7f2b2d4fb3c2f91d6ba2eab8d546c
MD5 hash:
e9a389a12256716b394c80a05e6065e0
SHA1 hash:
dcc8dcb2cf8debef05959f09054fab0f2e08b3f8
Link:
https://www.unpac.me/results/66a4843b-31f5-43d5-a89e-e2808cf6b0c8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/281de330768f7e2231f3984b2fbac04bf9f7f2b2d4fb3c2f91d6ba2eab8d546c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/109617/

Comments