MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bb05e5659640ee6fb1a853be63555c87fbcf3e13eccd0eff98be65157cd55c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MyDoom


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bb05e5659640ee6fb1a853be63555c87fbcf3e13eccd0eff98be65157cd55c9
SHA3-384 hash: 08c5584c7062270e3922489204edb0bb0bf868b4a338b353f1535bd5ee91888d2bf9e19cc0f0e887e993f1125951e490
SHA1 hash: 20e8dd38ba6ab4d447fa344a8ef70e8314441e05
MD5 hash: 4de378ff07d40c543ac23a640c87d90d
humanhash: fish-bakerloo-burger-seventeen
File name:2bb05e5659640ee6fb1a853be63555c87fbcf3e13eccd0eff98be65157cd55c9
Download: download sample
Signature MyDoom
Create hunting rule
File size:46'708 bytes
First seen:2020-11-07 19:15:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5d02f6de12eb07fb22fe87e05e50d6a0 (131 x MyDoom)
ssdeep 768:SCIqdH/k1ZVcT194jpBXUfR7l6nQx0F63j0WCLp91kQbXlnJhIoheArN:SNqaLV8aPUfll6nQx0Q3jPCl917VnHIU
Threatray 18 similar samples on MalwareBazaar
TLSH 7A23F1957A27E6C3D14CE4BB9D33BDB024526D7814D9C1223FA07BAFD671E283699031
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Worm.Mydoom-5
Create hunting rule

Win.Worm.Mydoom-6804110-0
Create hunting rule

Win.Worm.Mydoom-7
Create hunting rule

Win.Worm.Mydoom-216
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the Windows directory
Searching for the window
Delayed reading of the file
Creating a file in the %temp% directory
Connection attempt
Launching a process
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2bb05e5659640ee6fb1a853be63555c87fbcf3e13eccd0eff98be65157cd55c9/
Gathering data
Verdict:
malicious
Similar samples:
089ec72adefa248d3de89c4e76cd4f0b1796de19c15a32e1ee7d8825385f4f46
MyDoom
0a5234bc3c80c508bcdcb942bb7b3adee8b924ca01f7a05f73d63019e0cc998d
MyDoom
50bc5eab97c30fc8a5727b329429d3c02244a5fa9bdcf4e3740d5a6cdb86d3d6
MyDoom
53e965eade166aa90d1ea47c6cf49ab444218d20b97ca6873bb87c9357fc366b
MyDoom
91482ca2a7ae1f4329661c0c1e9edf4173483f3b9ea776b1daa2b329e364ed6c
MyDoom
aed37426ab1392058ce03af3d837334bc2127d1cc588f3ce099356934eddb1e8
MyDoom
d3edebb85f895fd4ab0579dbdefbcbb13779af0ec4b6adc17bac3e1b24b6bdbc
MyDoom
e0f9f893f02c3bd8ef86da41af4e256933e741d08e80481bc7ef157293105187
MyDoom
e181173a790c05deabbc8e2bf99c7ee55349b47e916d2bf7373cc13691f88aa9
MyDoom
e7762f57fb5e45ea8395e9c607702142c9d4875b9ed7cb5717bb77507aacc318
MyDoom
+ 8 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/201108-2e12t3z16a/
Behaviour
Drops file in Program Files directory
Drops file in Windows directory
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments