MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54b9b3a38edf2179e1c6cfb360d836b4a27249dfdbf57819d4ee354846f9f264. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54b9b3a38edf2179e1c6cfb360d836b4a27249dfdbf57819d4ee354846f9f264
SHA3-384 hash: 90ac1a6de3b9a8c1be6699453ab8ed262049bb8ec416567a553151987cdff55c4a930f027c97ff4896d92dfc63ea0e11
SHA1 hash: 8a3c8bb374c0ccaeaa5090023ca39ef43c5d5f09
MD5 hash: a9b6a3d485f33225f43d96ac0ec088af
humanhash: white-idaho-arkansas-jupiter
File name:44250743787152800000.dat
Download: download sample
File size:1'100'800 bytes
First seen:2021-02-23 18:19:04 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash e55392d3d4f1a5698962f329e1e15c67
ssdeep 24576:xSJSZexOkGdBfQjH0ypAGgpHSUo3H1H36EKJtp050Yjpov:xr3M0/JEKJtWyYqv
Threatray 1 similar samples on MalwareBazaar
TLSH 9F358D26F2D14433C1772A7C8C6B6758A83BBE016E38784A7BE41D4C9F396417A353A7
Reporter Anonymous

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/118768/
Detection(s):
SecuriteInfo.com.Adware.Generic4.BBFB.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the Windows subdirectories
Launching a process
Modifying an executable file
Creating a process with a hidden window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
22 / 100
Link:
https://www.joesandbox.com/analysis/615873
Signature
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 356946 Sample: 44250743787152800000.dat Startdate: 23/02/2021 Architecture: WINDOWS Score: 22 13 Machine Learning detection for sample 2->13 7 loaddll32.exe 1 2->7         started        process3 process4 9 rundll32.exe 7->9         started        process5 11 WerFault.exe 23 9 9->11         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/54b9b3a38edf2179e1c6cfb360d836b4a27249dfdbf57819d4ee354846f9f264/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-23 18:20:08 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
87f73c5d350eb7ba4050308ca928043c654baa04a90564737f37e76497552e92
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210223-35wh9z1jge/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
54b9b3a38edf2179e1c6cfb360d836b4a27249dfdbf57819d4ee354846f9f264
MD5 hash:
a9b6a3d485f33225f43d96ac0ec088af
SHA1 hash:
8a3c8bb374c0ccaeaa5090023ca39ef43c5d5f09
Link:
https://www.unpac.me/results/1960d302-f586-4cfb-9912-acddba612b76/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/54b9b3a38edf2179e1c6cfb360d836b4a27249dfdbf57819d4ee354846f9f264

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DLL dll 54b9b3a38edf2179e1c6cfb360d836b4a27249dfdbf57819d4ee354846f9f264

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/118768/
  
URLhaus
https://urlhaus.abuse.ch/url/1018306/
  
Delivery method
Distributed via web download

Comments