MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f9d6b736fbd00a1b8790ab77d6bde5b573b2177b7606724d2b6406839ceae3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f9d6b736fbd00a1b8790ab77d6bde5b573b2177b7606724d2b6406839ceae3d
SHA3-384 hash: 370ff1786118f1c79d3bf4d3ce5e64df79c7e41d9e7ab6d78c499fc5c365011a4b0ecee3084a37ab8dbd9f78b3889cdb
SHA1 hash: fc2517f19af1d1f84d06ee532bdef1469f63267c
MD5 hash: 3da9f7689d413fc9578aba22a78da839
humanhash: river-violet-pennsylvania-cola
File name:3da9f7689d413fc9578aba22a78da839.exe
Download: download sample
File size:2'003'274 bytes
First seen:2021-08-31 08:54:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b78ecf47c0a3e24a6f4af114e2d1f5de (295 x GuLoader, 23 x Formbook, 21 x RemcosRAT)
ssdeep 49152:edzwtiBW+oUcWH9b7eD3cQFP2QlQoZ/6kRgJiRSy:oztW0dZlQlQoZ/6UgJ+
Threatray 738 similar samples on MalwareBazaar
TLSH T1F895333BBBD0DCEBC6D6A031C06E37530AF45744C1A06F29534A656EFADB2504EAB607
dhash icon 69ccd4d49696cc71 (13 x Adware.Adload, 8 x CoinMiner, 7 x ValleyRAT)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/184094/
Detection(s):
SecuriteInfo.com.BackDoor.Siggen2.2488.26461.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c41cfa9c-37bd-4548-9067-ee88a64c157c
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/842416
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f9d6b736fbd00a1b8790ab77d6bde5b573b2177b7606724d2b6406839ceae3d/
Threat name:
Win32.Trojan.Phonzy
Create hunting rule
Status:
Malicious
First seen:
2021-08-31 00:54:12 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1273c78b4f196fc982cb1e9b7abe9d2b5c4f10c5486e7a891615bb273fef419d
35e4927ea02978e01bee3917c5c2c92d46308473bf3eaf4ef1d4d3c0eb0a0d4f
3de11e9ba2b8db6be4069506a95bc31250d8ae8d0df5e8fec66121a05f1ccbc6
5f2846d5daa6e5781427feb62144502ff1522b8250eadbfb7aa3602d04eac1fb
6997b092bad4debd075be5e71976075f262e0e21f47e34db16ba1985d51d8017
861f5a47b316a7668eedc2c5b7f7780406735223bd41a2a29f5df29331f7e51f
88c642b1fa43b77487f3916dd95ac236189971475c3289c745dc45a739e6453f
a5c940653c3b19cacd1378f2081feb377f2791257fbef36cd64df3a0b1b7d4b4
dcb25316bc3b1978f4acb2cce9804787843d832b46939195550ccdfc2f7f947c
f98183a2ad674f8aae6ad47e7da8b48c80175148ba333f0f57b3e6eca64bfaa6
+ 728 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210831-2c1astflm6/
Behaviour
Enumerates physical storage devices
Unpacked files
SH256 hash:
4f9d6b736fbd00a1b8790ab77d6bde5b573b2177b7606724d2b6406839ceae3d
MD5 hash:
3da9f7689d413fc9578aba22a78da839
SHA1 hash:
fc2517f19af1d1f84d06ee532bdef1469f63267c
Link:
https://www.unpac.me/results/58989c5a-080a-44d2-b904-2ab0c97b1aa3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.22
Link:
https://yomi.yoroi.company/submissions/4f9d6b736fbd00a1b8790ab77d6bde5b573b2177b7606724d2b6406839ceae3d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 4f9d6b736fbd00a1b8790ab77d6bde5b573b2177b7606724d2b6406839ceae3d

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/184094/
  
URLhaus
https://urlhaus.abuse.ch/url/1540376/
  
Delivery method
Distributed via web download

Comments