MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31960e88d4d665dffd9121c10a7a2e23daf2557ee5a3ca24d4f8263e28abc01f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31960e88d4d665dffd9121c10a7a2e23daf2557ee5a3ca24d4f8263e28abc01f
SHA3-384 hash: 1e78b71b158cf3fa60290c94cc515ae8f8238ccc2d5fc69c3becd41dbe9471c7ab36e946fd0cc88fcd0f843a1404774b
SHA1 hash: 48df68b361cc0c423692e54024e0c6adcb74a16d
MD5 hash: 37a7fa59e6318be466f5673010c8aaf0
humanhash: network-washington-papa-item
File name:QYoQ0qUhiT.exe
Download: download sample
File size:338'145 bytes
First seen:2020-09-10 11:53:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 027ea80e8125c6dda271246922d4c3b0 (10 x njrat, 7 x DCRat, 5 x DarkComet)
ssdeep 6144:rsCwu+mWhJifvtNP/7YXSLB80PDl3hR3ps3pkg:AxmIJQvPkitXRR3ps3pkg
TLSH E1749E02B7D140B2E5B329355939EB34A93CBD201E34CA5F67C42D6FBA71581A631FA3
Reporter Anonymous

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/58374/
Detection(s):
PUA.Win.Ransomware.Protected-6611653-0
Create hunting rule

SecuriteInfo.com.BehavesLike.Win32.Backdoor.tc.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
bank
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/463130
Signature
Command shell drops VBS files
Installs new ROOT certificates
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Registers a new ROOT certificate
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 283964 Sample: QYoQ0qUhiT.exe Startdate: 10/09/2020 Architecture: WINDOWS Score: 64 24 Multi AV Scanner detection for submitted file 2->24 26 Machine Learning detection for sample 2->26 28 Registers a new ROOT certificate 2->28 7 QYoQ0qUhiT.exe 14 2->7         started        process3 process4 9 cmd.exe 2 7->9         started        file5 22 C:\Users\user\AppData\Local\Temp\tmp.vbs, ASCII 9->22 dropped 30 Command shell drops VBS files 9->30 32 Registers a new ROOT certificate 9->32 13 certutil.exe 1 1 9->13         started        16 cscript.exe 1 9->16         started        18 certutil.exe 1 1 9->18         started        20 conhost.exe 9->20         started        signatures6 process7 signatures8 34 Installs new ROOT certificates 13->34
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31960e88d4d665dffd9121c10a7a2e23daf2557ee5a3ca24d4f8263e28abc01f/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2019-03-08 18:04:19 UTC
AV detection:
10 of 29 (34.48%)
Threat level:
  5/5
Verdict:
unknown
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/200910-1ta43exrfs/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/31960e88d4d665dffd9121c10a7a2e23daf2557ee5a3ca24d4f8263e28abc01f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/58374/

Comments