MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fc60a83ef20e211458314b964dd532fa2ddedf042b508f5512b41f05f731116. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DispCashBR


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fc60a83ef20e211458314b964dd532fa2ddedf042b508f5512b41f05f731116
SHA3-384 hash: 343549f8aad80e3287abf6b191d6a5e611e8eaa7bddb670284781a540e3da6b057ee565707bac0befcffcfd9a31fb572
SHA1 hash: cfee50393163302624601ce0fc4253e67c58a2f8
MD5 hash: 962107136505a0f18302ce3976fd5479
humanhash: four-pennsylvania-item-timing
File name:bn.exe
Download: download sample
Signature DispCashBR
Create hunting rule
File size:44'547 bytes
First seen:2021-04-30 18:04:47 UTC
Last seen:2021-04-30 19:02:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5d73b1e673b0c8b899b5f2db7b59b63b (2 x DispCashBR)
ssdeep 768:u5kkt6BmyabyqNuQ0p3g71/AYz1luhLrXAAvg5OHKtadM:skkt6BmyabyqNuQ0p3g71/AYz1luhvPY
Threatray 12 similar samples on MalwareBazaar
TLSH 3213A594AFE49CE3EF0242BD54EBC27F663CF2E4C6030B46B77071792652E952AD4A05
Reporter r3dbU7z
Tags:DispCashBR exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/147720/
Detection(s):
SecuriteInfo.com.Trojan.ATMDispCash.29.9176.20117.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DispCashBR
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/16401bcd-bea4-4f4d-a787-8111e3519b49
Result
Threat name:
Unknown
Detection:
malicious
Classification:
bank
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/705399
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file imports functions from msxfs.dll (often used by ATM malware)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3fc60a83ef20e211458314b964dd532fa2ddedf042b508f5512b41f05f731116/
Threat name:
Win32.Trojan.CessoATM
Create hunting rule
Status:
Malicious
First seen:
2021-04-30 18:05:14 UTC
AV detection:
19 of 47 (40.43%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
12278a4c7c9600fbe9e527388a4d96b5d29e110cf630d20ddc1efdb8f069b3c9
DispCashBR
1ae19b40a0ee8af19c35df837183c23efa7bb48bf0daf38769d2b12aaf26c255
DispCashBR
1ebbf5127ddc28f2e0e70a630acea23bf8734ea6405811b8e35c9acaca5b7174
DispCashBR
3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1426760cc6f8fef14821
DispCashBR
536db2930da96c059b10843fbb82ca8b53e3b10da458344d63c7fc5417a08fc4
DispCashBR
54f0211463fd813773ab82311eee3104c041b17a37e8c6308457294321d3587a
DispCashBR
74f7347811cf671e798e71e5efafdc0577845f97af9f0b81a9ec71fee32cb51e
DispCashBR
e9056b5596854e3473033e3b28577c83a70f1b5be20e4b1cf529688ad7591b70
DispCashBR
f40314a4c56831c08fe64721eb42a7ce52a08b25d6722343e8365327be940483
DispCashBR
f9d9f5051fcc32e496d5a1ca1ced94e045cd75e7607f328727469de7482174d4
DispCashBR
+ 2 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210430-kevnystx3a/
Unpacked files
SH256 hash:
3fc60a83ef20e211458314b964dd532fa2ddedf042b508f5512b41f05f731116
MD5 hash:
962107136505a0f18302ce3976fd5479
SHA1 hash:
cfee50393163302624601ce0fc4253e67c58a2f8
Detections:
win_dispcashbr_auto
Create hunting rule
win_dispcashbr_w0
Create hunting rule
Link:
https://www.unpac.me/results/ce6eab02-be79-4fc0-9671-fa125d74a502/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3fc60a83ef20e211458314b964dd532fa2ddedf042b508f5512b41f05f731116

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_dispcashbr_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_dispcashbr_w0
Create hunting rule
Author:Frank Boldewin (@r3c0nst)
Description:Detects of ATM Malware DispCashBR
Reference:https://twitter.com/r3c0nst/status/1232944566208286720

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/147720/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-30 19:00:31 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0052] File System Micro-objective::Writes File
1) [C0007] Memory Micro-objective::Allocate Memory
2) [C0018] Process Micro-objective::Terminate Process