MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5036daccd356ba9794957dc02668b903e2779eb2865aa2cf6605c8cb9f639da6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 5036daccd356ba9794957dc02668b903e2779eb2865aa2cf6605c8cb9f639da6
SHA3-384 hash: d35a3d93ed13cdf0c17d88adc3f10b8f8ae59badc9158a5fe35dfb33e14cd4166000a5205bbc06a7dd3f952c43e48c0a
SHA1 hash: 66777253c5d7691b409ba23e587fd530dd3b9291
MD5 hash: 802e683af9dae89d568acaab6715ce6c
humanhash: table-fix-arizona-oregon
File name:satan_1.0.0.14.vir
Download: download sample
Signature ZeuS
File size:189'233 bytes
First seen:2020-07-19 19:36:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 65e9607e6f28a7852bb41a6e2e439a92
ssdeep 3072:ZAeKQnE7OhssdWJ5jy392aCmCbBqruyUa7nwRY227wXMMryUA01+nhXU:GSvhssdu5jyYaCmCQrdUa7nxaMcTAvn2
TLSH 3604F27CB5041DFDE76E267BDA85B9BC13761812E949888191ED6FC220E33B0FE53506
Reporter @tildedennis
Tags:satan ZeuS


Twitter
@tildedennis
satan version 1.0.0.14

Intelligence


File Origin
# of uploads :
1
# of downloads :
22
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247405 Sample: satan_1.0.0.14.vir Startdate: 20/07/2020 Architecture: WINDOWS Score: 100 62 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->62 64 Antivirus / Scanner detection for submitted sample 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 6 other signatures 2->68 11 satan_1.0.0.14.exe 2->11         started        process3 dnsIp4 54 1.0.0.14 CLOUDFLARENETUS Australia 11->54 92 Detected unpacking (overwrites its own PE header) 11->92 94 Contains functionality to encrypt and move a file in one function 11->94 96 Drops batch files with force delete cmd (self deletion) 11->96 98 2 other signatures 11->98 15 satan_1.0.0.14.exe 3 11->15         started        signatures5 process6 file7 50 C:\Users\user\AppData\Roaming\...\wucy.exe, PE32+ 15->50 dropped 52 C:\Users\user\AppData\...\tmp_394b3111.bat, DOS 15->52 dropped 18 wucy.exe 15->18         started        21 cmd.exe 1 15->21         started        process8 signatures9 70 Antivirus detection for dropped file 18->70 72 Detected unpacking (overwrites its own PE header) 18->72 74 Tries to detect sandboxes and other dynamic analysis tools (window names) 18->74 76 4 other signatures 18->76 23 wucy.exe 18->23         started        26 conhost.exe 21->26         started        process10 signatures11 84 Injects code into the Windows Explorer (explorer.exe) 23->84 86 Writes to foreign memory regions 23->86 88 Allocates memory in foreign processes 23->88 90 3 other signatures 23->90 28 explorer.exe 4 12 23->28 injected 32 svchost.exe 23->32 injected 34 sihost.exe 23->34 injected 36 10 other processes 23->36 process12 dnsIp13 56 5f4vtuymlsrwczfo.onion.pw 28->56 58 pixie.porkbun.com 44.227.65.245, 49717, 49718, 49719 AMAZON-02US United States 28->58 100 May disable shadow drive data (uses vssadmin) 28->100 102 Creates autostart registry keys with suspicious names 28->102 104 Deletes shadow drive data (may be related to ransomware) 28->104 108 4 other signatures 28->108 38 wucy.exe 28->38         started        41 vssadmin.exe 1 28->41         started        43 SearchUI.exe 28->43 injected 60 84.53.167.113, 49692, 80 AKAMAI-ASUS European Union 32->60 106 Contains functionality to encrypt and move a file in one function 32->106 signatures14 process15 signatures16 78 Modifies the context of a thread in another process (thread injection) 38->78 80 Hides threads from debuggers 38->80 82 Injects a PE file into a foreign processes 38->82 45 wucy.exe 38->45         started        48 conhost.exe 41->48         started        process17 signatures18 110 Hides threads from debuggers 45->110
Threat name:
Win32.Trojan.Nasan
Status:
Malicious
First seen:
2017-02-23 08:27:13 UTC
AV detection:
27 of 29 (93.10%)
Threat level
  5/5
Result
Malware family:
n/a
Score:
  9/10
Tags:
ransomware persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Interacts with shadow copies
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Interacts with shadow copies
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Modifies service
Modifies service
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Checks whether UAC is enabled
Adds Run key to start application
Deletes itself
Loads dropped DLL
Executes dropped EXE
Executes dropped EXE
Deletes shadow copies
Deletes shadow copies
Threat name:
Unknown
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments