MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60
SHA3-384 hash: ac99a4b76c2e32a6488046039c7da749f159be68c648eececb19ff160ab93c3aa423f57055c20177d58bd62ac1a18f84
SHA1 hash: 76cc795c39cc19465c24825dc5ebafd7f944ea7e
MD5 hash: eaef25ab1f59492ffc735a386294b69f
humanhash: beer-delaware-august-blue
File name:4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.bin
Download: download sample
File size:67'072 bytes
First seen:2020-09-17 20:04:22 UTC
Last seen:2020-09-17 20:41:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e82dd51b077167be63c004bed23d0c1e (40 x NetWalker, 2 x GuLoader, 1 x ShikataGaNai)
ssdeep 1536:kxZab6DtoaWM7pgUJJooLrIZadXRM0CFU6InWU1dil:3GDtDD7prbooLrWaPM0hWai
Threatray 43 similar samples on MalwareBazaar
TLSH E2636CC3F682D0B1D58606F926EFF6BE04376C18A739C9C3CB516D40EA315D2993A74A
Reporter Dashowl
Tags:NetWalker Ransomware

Intelligence

File Origin
# of uploads :
2
# of downloads :
2'024
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Netwalker
Create hunting rule
Link:
https://www.capesandbox.com/analysis/63031/
Detection(s):
SecuriteInfo.com.Trojan.Encoder.32553.6806.7182.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Changing a file
Creating a file
Modifying an executable file
Moving a file to the Program Files subdirectory
Creating a file in the Program Files subdirectories
Reading critical registry keys
Creating a window
Creating a file in the mass storage device
Encrypting user's files
Result
Threat name:
Netwalker
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/469517
Signature
Antivirus / Scanner detection for submitted sample
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Netwalker ransomware
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60/
Threat name:
Win32.Ransomware.NetWalker
Create hunting rule
Status:
Malicious
First seen:
2020-09-10 19:29:14 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0d7ee7ce88e790ad66aa53589f5a2638207bc3adf2eb4f8a813fd52b5b22ba27
12717add64ecf32d7bcb6b2662becbff6b516cf8073f399dc5e4d3615d452e89
167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49
26dfa8512e892dc8397c4ccbbe10efbcf85029bc2ad7b6b6fe17d26f946a01bb
29aef790399029029e0443455d72a8b928854a0706f2e211ae7a03bba0e3d4f4
3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e
4df67a9e8abab33856a586cea38b0d365fbbe0d91ee848f270c65f0125d2d677
74fd9bbdd8a484640e4b0405a1da84734a0a9c2604ac1b0a39fa2e28b0c12614
84b8dbafd5cd64fb300b30bf943430a18f34cad3f0d8f7251d34354fea85aab2
b2d68a79a621c3f9e46f9df52ed19b8fec22c3cf5f4e3d8630a2bc68fd43d2ee
+ 33 additional samples on MalwareBazaar
Result
Malware family:
mailto_hamlampampom
Create hunting rule
Score:
  10/10
Tags:
ransomware spyware family:mailto_hamlampampom
Link:
https://tria.ge/reports/200917-nl6k7ebwlx/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Deletes itself
Reads user/profile data of web browsers
Modifies extensions of user files
MailTo (Hamlampampom Variant)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Filecoder
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_mailto_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/63031/

Comments