MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34cf81e9eb35d742e3a8ae9a8c0fb2f024c388797e24960f730d3df86ed8c807. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34cf81e9eb35d742e3a8ae9a8c0fb2f024c388797e24960f730d3df86ed8c807
SHA3-384 hash: 2dd5a5182f46034e687a896604c9c7dded5d72bea1b0bd5995384d9d21f0e42a7669f4cc725d5301fee4aef2685df6e2
SHA1 hash: 6931d862e06389fb2ccb4f880854cfbe932423dc
MD5 hash: 52a441a510c2400956fa887f1576c1cf
humanhash: table-sad-stream-seven
File name:52a441a510c2400956fa887f1576c1cf.exe
Download: download sample
File size:2'020'063 bytes
First seen:2021-08-26 12:45:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep 49152:Fo0xfu1sR9O01zOlXJXhcUR1P90mvsAC5rdYi:xfXRsbRc+1PimvsACHT
TLSH T1E69533DBCB9165E9EC490075927DA75FBCC9E8B00196339DDB67411CF0D38069CA8DE2
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
52a441a510c2400956fa887f1576c1cf.exe
Verdict:
No threats detected
Analysis date:
2021-08-26 12:48:12 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d6e61fa1-a491-4baf-8b43-d43929eef9ad

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/182649/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46869238.6879.25734.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/0a5158c4-c0be-4cc1-9a56-078401f648fd
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/839830
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34cf81e9eb35d742e3a8ae9a8c0fb2f024c388797e24960f730d3df86ed8c807/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-08-26 12:46:17 UTC
AV detection:
13 of 42 (30.95%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  7/10
Tags:
themida
Link:
https://tria.ge/reports/210826-l445q6bl32/
Unpacked files
SH256 hash:
34cf81e9eb35d742e3a8ae9a8c0fb2f024c388797e24960f730d3df86ed8c807
MD5 hash:
52a441a510c2400956fa887f1576c1cf
SHA1 hash:
6931d862e06389fb2ccb4f880854cfbe932423dc
Link:
https://www.unpac.me/results/c72d5495-a902-4d8d-a159-3501a70c788b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/34cf81e9eb35d742e3a8ae9a8c0fb2f024c388797e24960f730d3df86ed8c807

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/182649/

Comments