MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4465deaaeff5c68689f14af3d9d27e67158fed1300c72d193b6f6c51b4ad69b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4465deaaeff5c68689f14af3d9d27e67158fed1300c72d193b6f6c51b4ad69b3
SHA3-384 hash: 15f0105e8c24be978eb764dac82add8ab92e73a0e6f28cd4ac8112c06177c8f3a6e6e3e80190fe06dcecabbcb70ed649
SHA1 hash: 87ee18bac3cf80f0cb56ff3502ea2eb02c23edba
MD5 hash: 93d00a52720b98570ad54a8ae5c2411a
humanhash: avocado-stairway-nebraska-oxygen
File name:wdqdwq.dll
Download: download sample
File size:16'384 bytes
First seen:2021-08-20 06:11:45 UTC
Last seen:2021-08-20 06:59:35 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 384:M1hOIy1JPfD1UGITVz8ywjfQP6mlY/Ou:EWXDFIRRwevlWOu
Threatray 58 similar samples on MalwareBazaar
TLSH T1B172191D93C49630E8FD1E7ACCA321914B71C75A8957EF3A25C8D052FFE329851A2722
Reporter JAMESWT_WT
Tags:dll pw 1

Intelligence

File Origin
# of uploads :
2
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/180869/
Detection(s):
SecuriteInfo.com.Artemis93D00A52720B.24255.26630.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ismdoor
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/98b36665-b887-417a-be2d-55599ef1e907
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/836243
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 468674 Sample: wdqdwq.dll Startdate: 20/08/2021 Architecture: WINDOWS Score: 52 13 Multi AV Scanner detection for submitted file 2->13 15 Machine Learning detection for sample 2->15 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        process5 11 rundll32.exe 9->11         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4465deaaeff5c68689f14af3d9d27e67158fed1300c72d193b6f6c51b4ad69b3/
Threat name:
Win32.Trojan.InjectorX
Create hunting rule
Status:
Malicious
First seen:
2021-08-20 06:12:09 UTC
File Type:
PE (.Net Dll)
Extracted files:
1
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1feda728feb0187e19e099ddfcb542c608b3ec67149592520c1515bc6d3ada03
263c44c0debf596d893d64e491c6ba5f31ccc06171fdd41abff109788a05ccec
2e2bc0ade577e2f509754da94fa4b5c3ec925964c170c00d365b7307f1716862
54ff8bf201c18be4c5685d5e80669d1aa817063c9a4a10d6a880c460fd0adf93
8479820a0aa9a814e532b5b2f6e7e172f3d3dd9f651375b695c37ca75c84d946
91c1a234f9f1c9bcefa5024b93d5d3dec10f8695a11173f57996df8f6324de79
9e614b7116a337119dc6f8c32722859fc862f485bc0169c66ad958b63744ceaf
a58cf7753cdff434e81e0163ec97f8e1a8b32c80ddfa7cbf021778a759f78842
cc8103242c41293f02ff2baf8ba6ef57470712ee2b2a99f2be83127409dd50b9
d7b59654644c399eaf13d7460b928ebf8f94bfd9e97e4a135ef005719e4eb18b
+ 48 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210820-4q2gm37312/
Unpacked files
SH256 hash:
4465deaaeff5c68689f14af3d9d27e67158fed1300c72d193b6f6c51b4ad69b3
MD5 hash:
93d00a52720b98570ad54a8ae5c2411a
SHA1 hash:
87ee18bac3cf80f0cb56ff3502ea2eb02c23edba
Link:
https://www.unpac.me/results/f51ef9e4-fd46-45be-9451-03c5a8d51f30/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/4465deaaeff5c68689f14af3d9d27e67158fed1300c72d193b6f6c51b4ad69b3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DLL dll 4465deaaeff5c68689f14af3d9d27e67158fed1300c72d193b6f6c51b4ad69b3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1548367/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/180869/

Comments