🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55f45920bfb21ab53d0c8fb4aededc3ee798170197fa2fd9b88dfcfeccdcac41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55f45920bfb21ab53d0c8fb4aededc3ee798170197fa2fd9b88dfcfeccdcac41
SHA3-384 hash: 2704cf8153397f7777e86979e2e6120b79904bc4b3f82d2e2598568a622ef3bad64b8096a9367808262d1bd13ac1929c
SHA1 hash: 60beb5b9555b08af7bad60a7d144974549194265
MD5 hash: 3d719cd32bfe24797ca5764c53e96c03
humanhash: lion-neptune-west-skylark
File name:SecuriteInfo.com.Mal.Gen.30705.31029
Download: download sample
File size:25'744'896 bytes
First seen:2021-03-24 22:43:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ec0c6c6b84d8d79504448840f06cabb0
ssdeep 786432:zIDx26vwGgfvVdPvv7F1p/HOSJ6/pcU+H5GEF4:zEvnqvVVtXJ0pcUW5C
Threatray 6 similar samples on MalwareBazaar
TLSH BD47E07F31A4926CC16EC27AC0A79F40E637B0755B32C6EB639112941F62AC59E7FB10
Reporter SecuriteInfoCom

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Mal.Gen.30705.31029
Verdict:
No threats detected
Analysis date:
2021-03-24 23:06:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1417a970-6136-44f6-b3e3-8a1f3a456b40

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Mal.Gen.30705.31029.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/653154
Signature
Creates an autostart registry key pointing to binary in C:\Windows
Hides threads from debuggers
Multi AV Scanner detection for submitted file
Obfuscated command line found
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
System process connects to network (likely due to code injection or exploit)
Tries to detect debuggers (CloseHandle check)
Tries to detect debuggers by setting the trap flag for special instructions
Tries to detect virtualization through RDTSC time measurements
Very long command line found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 375528 Sample: SecuriteInfo.com.Mal.Gen.30... Startdate: 25/03/2021 Architecture: WINDOWS Score: 92 39 googlehosted.l.googleusercontent.com 2->39 41 doc-0c-bg-docstext.googleusercontent.com 2->41 65 Multi AV Scanner detection for submitted file 2->65 67 PE file contains section with special chars 2->67 10 loaddll64.exe 1 2->10         started        13 rundll32.exe 2->13         started        15 rundll32.exe 2->15         started        signatures3 process4 signatures5 69 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->69 71 Obfuscated command line found 10->71 73 Very long command line found 10->73 75 3 other signatures 10->75 17 rundll32.exe 10->17         started        20 rundll32.exe 4 1 10->20         started        23 cmd.exe 1 10->23         started        25 5 other processes 10->25 process6 dnsIp7 51 System process connects to network (likely due to code injection or exploit) 17->51 53 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 17->53 55 Tries to detect debuggers by setting the trap flag for special instructions 17->55 57 Tries to detect virtualization through RDTSC time measurements 17->57 45 sortedforyou.com 104.21.12.130, 443, 49715 CLOUDFLARENETUS United States 20->45 47 googlehosted.l.googleusercontent.com 172.217.168.33, 443, 49713, 49735 GOOGLEUS United States 20->47 49 doc-0c-bg-docstext.googleusercontent.com 20->49 59 Creates an autostart registry key pointing to binary in C:\Windows 20->59 61 Tries to detect debuggers (CloseHandle check) 20->61 63 Hides threads from debuggers 20->63 27 rundll32.exe 23->27         started        30 WerFault.exe 9 25->30         started        32 WerFault.exe 9 25->32         started        signatures8 process9 signatures10 77 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 27->77 79 Tries to detect debuggers (CloseHandle check) 27->79 81 Hides threads from debuggers 27->81 34 WerFault.exe 20 9 27->34         started        process11 dnsIp12 43 192.168.2.1 unknown unknown 34->43 37 conhost.exe 34->37         started        process13
Gathering data
Threat name:
Win64.Trojan.Mekotio
Create hunting rule
Status:
Malicious
First seen:
2021-03-24 01:55:15 UTC
AV detection:
11 of 29 (37.93%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
057c4c59d55129c9c6877afc5f428c59f86645e244383ee777d7f62d067e286e
4d45380cd5fdf967988c4f239f61827ad9a80a4d9abcfbddf6e656d9dcc50f58
4e69e794a688f94bd865b9905f2e8cc84bf17d282020ff08f2f56b42f1ffd305
569be6a3e9eeede01d5b2bab288aba6de5d5759684ed526986b8d01923c591af
6bd76be4ebf2b1fa8a1580609fb475a10b669baa3d1744eaa58f3ec2df393dad
92956d8d80a5032afc293e59db2523f649227980524b55cfaf0402545bc57050
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/210324-pzg2bw7gr2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/55f45920bfb21ab53d0c8fb4aededc3ee798170197fa2fd9b88dfcfeccdcac41

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments