MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 418cc6f42a9c585548d8f02ca7c605723b657172483b904c35ccd69a8bf62c6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 418cc6f42a9c585548d8f02ca7c605723b657172483b904c35ccd69a8bf62c6c
SHA3-384 hash: 735f63207141dcee216344fa7a972f56b3a11b1257ab9a95251b36589cce5031c5cdad6e50f63383ef660ef25284983d
SHA1 hash: 534a872b312a86326a67cd54dc08f434db8f4b11
MD5 hash: c8268d852b421d615d7e649ddcd4c2f3
humanhash: fillet-harry-west-mexico
File name:418cc6f42a9c585548d8f02ca7c605723b657172483b904c35ccd69a8bf62c6c
Download: download sample
File size:1'164'993 bytes
First seen:2020-11-07 18:59:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 24576:JanwhSe11QSONCpGJCjETPlgXWZ5PbcmC3f/DFNkTQbQokaxV:knw9oUUEEDlB7jcmWH/xbQUj
Threatray 110 similar samples on MalwareBazaar
TLSH 0C4533611D39789AC3B9153C20951D008AAA9B9D944CAEB0E3F216D32F7E7FF3D2950D
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Eati-7331386-0
Create hunting rule

Win.Malware.Eati-7331431-0
Create hunting rule

Win.Malware.Eati-7331499-0
Create hunting rule

Win.Malware.Eati-7331637-0
Create hunting rule

Win.Malware.Eati-7331642-0
Create hunting rule

Win.Malware.Eati-7332809-0
Create hunting rule

Win.Trojan.Mansabo-9670631-0
Create hunting rule

Win.Trojan.Mansabo-9787656-0
Create hunting rule

Win.Trojan.Mansabo-9787658-0
Create hunting rule

Win.Trojan.Mansabo-9787665-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the system32 directory
Creating a process from a recently created file
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Base64 Encoded Powershell Directives
Detected one or more base64 encoded Powershell directives.
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/418cc6f42a9c585548d8f02ca7c605723b657172483b904c35ccd69a8bf62c6c/
Gathering data
Verdict:
malicious
Similar samples:
1dd414720243b16b069349dbea2d76edce769e5355cf9e9e627a98fea76052d1
420c41c15390d4a810ac457c87022f7b925b7d951d24c9be7652b7ec4ce86201
48c2539ec1293477679043d54af606a3340a444cb0f449f8eafcf0141efaf04b
6f27f77c69198067b4565c025b838ec528eee86e4ac3cb1cd89ffb2c07124fdb
919269592bd17fee63c08a140bc5c9dc18daf21f4c3afb27716aad0b71fd4cf4
948124a03f3636a6f2d95a1ea87db46a52d97d24011d4f70f8ca4387f7a3903d
beeac63084be78c60a9ea959a979b2c6fd8ce40483fd9b737c49c82f390ccf45
caaf6c0b486cfaf8c99615e8016fb588ed6a14a6b29af81982299ed3cec3fa54
d950e53eb1210eee8072df072d90bf4d773a0eb1c84906fd706eae82387893f3
ddd1ffbec2f733c514c08f75d02302f30e69f7295a109e1361087c4ac36f9ab6
+ 100 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201108-8jkh7cxmcs/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments