MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52c0523a4ebf65f913e30e1c50b3bb7fc231d21774b6a1104caf106e1b0d6b5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52c0523a4ebf65f913e30e1c50b3bb7fc231d21774b6a1104caf106e1b0d6b5a
SHA3-384 hash: bdc34fa5fd2f408a54e364b476400463f453112b7c595e5b25cd66916e5ad890d9bd3015109dc0fb284056a7221bdcef
SHA1 hash: 72b0237b7b112d13098032091eb3ed01247ee1a0
MD5 hash: 89cb8507a6950e3b416c4fb382ed4be1
humanhash: nebraska-sierra-finch-robert
File name:52c0523a4ebf65f913e30e1c50b3bb7fc231d21774b6a1104caf106e1b0d6b5a
Download: download sample
File size:476'034 bytes
First seen:2020-06-29 07:25:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4511896d043677e4ab4578dc5bcab5a0 (35 x SakulaRAT)
ssdeep 6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7kn5F:0RfQn+w8EYiBlMkn5f9J105ko8TP
Threatray 134 similar samples on MalwareBazaar
TLSH 7FA439646ACEC4F3D347B4B268B2B39125F2BC289A1AF51E93C86F3CD473D80655D906
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Sakula
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15608/
Detection(s):
Win.Downloader.Upatre-5744092-0
Create hunting rule

Win.Downloader.Upatre-5744094-0
Create hunting rule

Win.Trojan.Generic-6296810-0
Create hunting rule

Win.Keylogger.Tinba-6622757-0
Create hunting rule

Win.Trojan.VBGeneric-6735876-0
Create hunting rule

Win.Malware.Scar-6745903-0
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52c0523a4ebf65f913e30e1c50b3bb7fc231d21774b6a1104caf106e1b0d6b5a/
Threat name:
Win32.Trojan.Sakurel
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 01:02:52 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
31 of 31 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
sakularat
Create hunting rule
Similar samples:
00207fd3bf8a379ab27531ab47b13c775d2519f10df9c331d4d64e90bd5206b9
1e4c52155582f5eeb5c7a946c20c2030b3c90303f1b23eb2261a8b9a91a8594f
1f89b0759c021884b598c36f30779d2aba64800f3dec7fdd45e6263ec8d7be23
2482e74612ee6630371130c86429a979a25f58b08c18a4b9695cd86dc87e80da
53497eda5fa82e772599ff5a303e488e19f85b12199c316514e6af6a79d88a46
88310a7eb0991c1088029656f81518ef578a45c786ca5b545bb355af0f36993d
a735f487179cdb2e5fb6a366750e12c774d485a6259cbdc8c0aa6f726b1992f7
ed4aef67444c1b22bd8ef038a1544fbcc65b602111020db1a5a2a88e1964e4f1
f82e3cf3a8fedbb9e49f82a5c56464377d6e384662c6586db1c14cb9670fcc88
fd7ee166a2ef80d3dc9668383540eade22f9cf7125a870bd0efb0f14b1239e31
+ 124 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/200629-qrkdnjajms/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Runs ping.exe
Adds Run entry to start application
Loads dropped DLL
Deletes itself
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15608/

Comments