MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2aa855e58f1d16de00731cb9406d658533187046015073f293265f85ce07ba45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2aa855e58f1d16de00731cb9406d658533187046015073f293265f85ce07ba45
SHA3-384 hash: 94c77abe86a635fe95be6fbdc309d0be775287623b9a25e2436b6a2559ae84a8c256cc967a042924ffee7ebd3412dd1c
SHA1 hash: cd28c716bf80cb96ffe4d94f19f27485d444cf4d
MD5 hash: 6085cefc3957964d9152918975238c9c
humanhash: item-bulldog-sodium-happy
File name:6085cefc3957964d9152918975238c9c
Download: download sample
File size:1'552'808 bytes
First seen:2021-06-24 12:13:59 UTC
Last seen:2021-06-24 12:53:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b34f154ec913d2d2c435cbd644e91687 (533 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep 24576:2cuzdtQcL7DMpl95wjd5Nsp1J4eVzNFq+KjXQu86OmTdDie+0Zy9yUeiIp8sHgiM:YZtTL7DMpz2BPYJ4yYjv86OmTxQ0y9y6
Threatray 3 similar samples on MalwareBazaar
TLSH DA7512156500C9B7E8055BB133C26BB32868607BFC0E2E72B0D71B4B5E39A255FBDE16
Reporter zbetcheckin
Tags:32 exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6085cefc3957964d9152918975238c9c
Verdict:
No threats detected
Analysis date:
2021-06-24 12:19:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/668f1a99-d376-4307-9de9-c261c8d05ebd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/168016/
Detection(s):
SecuriteInfo.com.Trojan.Siggen13.47795.12778.13309.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/823a11f8-4484-4b0e-b980-b8eed97b9a2e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
42 / 100
Link:
https://www.joesandbox.com/analysis/807445
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Creates an undocumented autostart registry key
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 439856 Sample: eQjZ5OS5m5 Startdate: 24/06/2021 Architecture: WINDOWS Score: 42 73 Multi AV Scanner detection for submitted file 2->73 9 eQjZ5OS5m5.exe 2 9 2->9         started        12 svchost.exe 2->12         started        15 KLUpdate.exe 8 2 2->15         started        18 12 other processes 2->18 process3 dnsIp4 55 C:\Users\user\AppData\...\KLUpdateSetup.exe, PE32 9->55 dropped 20 KLUpdateSetup.exe 74 9->20         started        77 Changes security center settings (notifications, updates, antivirus, firewall) 12->77 23 MpCmdRun.exe 12->23         started        69 flownetserv.com 15->69 71 127.0.0.1 unknown unknown 18->71 file5 signatures6 process7 file8 47 C:\Program Files (x86)\KL\...\KLUpdate.exe, PE32 20->47 dropped 49 C:\Program Files (x86)\KL\...\psuser_64.dll, PE32+ 20->49 dropped 51 C:\Program Files (x86)\KL\Temp\...\psuser.dll, PE32 20->51 dropped 53 65 other files (none is malicious) 20->53 dropped 25 KLUpdate.exe 20 73 20->25         started        29 conhost.exe 23->29         started        process9 file10 57 C:\Program Files (x86)\KL\...\KLUpdate.exe, PE32 25->57 dropped 59 C:\Program Files (x86)\KL\...\psuser_64.dll, PE32+ 25->59 dropped 61 C:\Program Files (x86)\KL\...\psuser.dll, PE32 25->61 dropped 63 66 other files (none is malicious) 25->63 dropped 75 Creates an undocumented autostart registry key 25->75 31 KLUpdate.exe 222 25->31         started        33 KLUpdate.exe 25->33         started        36 KLUpdate.exe 53 25->36         started        38 KLUpdate.exe 25->38         started        signatures11 process12 dnsIp13 40 KLUpdateComRegisterShell64.exe 99 31->40         started        43 KLUpdateComRegisterShell64.exe 6 31->43         started        45 KLUpdateComRegisterShell64.exe 6 31->45         started        65 flownetserv.com 172.67.223.135, 443, 49729, 49730 CLOUDFLARENETUS United States 33->65 process14 dnsIp15 67 1.3.36.71 CLOUDFLARENETUS China 40->67
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2aa855e58f1d16de00731cb9406d658533187046015073f293265f85ce07ba45/
Threat name:
Win32.Dropper.Dapato
Create hunting rule
Status:
Malicious
First seen:
2021-06-17 03:31:52 UTC
AV detection:
11 of 29 (37.93%)
Threat level:
  3/5
Verdict:
suspicious
Similar samples:
07dd788eaf264a645dce4b24536deda60690bba09125d2c9babc7ec786734344
b223137961759aab259243f94f9961d6d98bdfef5dfe325ac6b1aabb822f7a68
c829830d55396b4d79630c268cc875bc59c950daac4ee0476560a2edc3f8f87a
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/210624-sy2z6drfl2/
Behaviour
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Modifies Installed Components in the registry
Sets file execution options in registry
Registers COM server for autorun
Unpacked files
SH256 hash:
2683e68d19d160ca6cd193a6d7e05c4530b5829e6c02fe2e0bdcfb74c2852765
MD5 hash:
fedbd2142d82ebcb3b4d15f7fa7bb489
SHA1 hash:
de7c4c42dff47327db63b906ed3d5268837d77e1
Link:
https://www.unpac.me/results/907d4635-f588-428b-b87a-cdbe42c3b344/
SH256 hash:
62661b54e8228380d625435e31373a8b28118b65fe3e22123fb0df2ee315e276
MD5 hash:
f40f5c8f784b4373b408f31c30432a28
SHA1 hash:
5e127483541ecd52508d7c6c4f2a3161289843fb
Link:
https://www.unpac.me/results/907d4635-f588-428b-b87a-cdbe42c3b344/
SH256 hash:
c405edfad0e6c2c390a5c784cfdc73ac12d2f2442472dfcc5dd404531b01c877
MD5 hash:
51d12e4661065cf49d90e29401e593de
SHA1 hash:
43f932054757c76bffff730a2f9ae095cd5187a2
Link:
https://www.unpac.me/results/907d4635-f588-428b-b87a-cdbe42c3b344/
SH256 hash:
86fa09a6c074daa0be247d00eeefbd4a65a49fcbf07c45d18078ec6ad78d8b67
MD5 hash:
dee2c8a9af42ea726b68d8dd4fa21211
SHA1 hash:
16c326858181ec0767a04b1c59e257dcd9377ec3
Link:
https://www.unpac.me/results/907d4635-f588-428b-b87a-cdbe42c3b344/
SH256 hash:
6427f3d29ce8c61fa95ae48c92775bf4996e8fd8ca5168db85554adf1f86d8f3
MD5 hash:
0d5ebb73c79d101de391cf52db25d974
SHA1 hash:
94d9808345de908c17250264956fdb54cad06323
Link:
https://www.unpac.me/results/907d4635-f588-428b-b87a-cdbe42c3b344/
SH256 hash:
a0f9f1d4265c1401bd42f6ac88d4f105f8337c5f8b5af0e3c63b61f8a16de814
MD5 hash:
64396ad529d22e6496d11949dbeeb328
SHA1 hash:
71a055e612845bf7d249ab0c82db0352453b5878
Link:
https://www.unpac.me/results/907d4635-f588-428b-b87a-cdbe42c3b344/
SH256 hash:
f0f5c6d95138feac4faa7d14dcf7f35c9678c473edc3845aa969d766dbc3d6b9
MD5 hash:
5276df64005eb9b12c952437ca009209
SHA1 hash:
08ba766ad7fe961690fa6a61637ec642a221f2d0
Link:
https://www.unpac.me/results/907d4635-f588-428b-b87a-cdbe42c3b344/
SH256 hash:
2aa855e58f1d16de00731cb9406d658533187046015073f293265f85ce07ba45
MD5 hash:
6085cefc3957964d9152918975238c9c
SHA1 hash:
cd28c716bf80cb96ffe4d94f19f27485d444cf4d
Link:
https://www.unpac.me/results/907d4635-f588-428b-b87a-cdbe42c3b344/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2aa855e58f1d16de00731cb9406d658533187046015073f293265f85ce07ba45

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 2aa855e58f1d16de00731cb9406d658533187046015073f293265f85ce07ba45

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/168016/

Comments