MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 561fc13bd3133437c5607e8697add803482e33dd9de9814fc86cc8e13a520b5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 561fc13bd3133437c5607e8697add803482e33dd9de9814fc86cc8e13a520b5b
SHA3-384 hash: 1471ba3e15882debb78d896bd2fa814cb1626249b2abfae4eb519432bf068a923951d8abb9f32528d423418569607fcf
SHA1 hash: 773a68a398a42ace6d05b504b656a40a01da7eca
MD5 hash: 4ed1ba2cb9ae7dbc8da5d9c1c0f4e29b
humanhash: kentucky-romeo-delta-quebec
File name:4ed1ba2cb9ae7dbc8da5d9c1c0f4e29b
Download: download sample
File size:667'136 bytes
First seen:2021-09-07 10:33:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6ed4f5f04d62b18d96b26d6db7c18840 (235 x SalatStealer, 78 x BitRAT, 42 x RedLineStealer)
ssdeep 12288:TXHe877LVTRKpJACQvHoZRfj3t7XzL7ei09Q1w+105RTk0yq10dXaQDIuNdyt:i87bKp/Qkz5/j++SRYNqQD/Ndyt
Threatray 20 similar samples on MalwareBazaar
TLSH T1F4E423E2F31D734EEAA49874560E048F04A57660DC35230CA949DEB836A761ABFDF1DC
Reporter zbetcheckin
Tags:32 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4ed1ba2cb9ae7dbc8da5d9c1c0f4e29b
Verdict:
Suspicious activity
Analysis date:
2021-09-07 10:33:56 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/554b57c5-6779-4603-91de-530730043213

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/185997/
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Malware family:
Glupteba
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b674aa31-6871-4c1e-9268-36bcc4cd7006
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/846509
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 478939 Sample: IdQSsQOtbG Startdate: 07/09/2021 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 6 IdQSsQOtbG.exe 1 2->6         started        process3 process4 8 conhost.exe 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/561fc13bd3133437c5607e8697add803482e33dd9de9814fc86cc8e13a520b5b/
Threat name:
Win32.Trojan.WinGoRanumBot
Create hunting rule
Status:
Malicious
First seen:
2021-09-03 12:47:50 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
07a3740166cef528ebddd4f594c555f7a07cee5260fb85d2840dded9ebbbd652
1bf37ce1ec0b4c02ee0d2fff1ac24d34627c754eab070dbcdf49e667b721a674
50ab699ceb6bb259199d197392ea0ed00d024ce77d3d663ea13fe7b93a4ab50e
64cc1575183bd3525e59a436b8c1930ac1fe60fabde4878e4f2256892499ef9a
68d83afa2dc4272e54c4ebb1ab8981e7f00442dfe6e66c8b7299c30a230be997
6ac8f87ce26a0a9ad330c8b42342b6891d12df43be535f9c487855182a39aa1f
79123c765ff9f7d116bbf4bd64a52c2bc33195a1287666ea379d89a5eaf0ec40
8980c8abaa3365782c905b3f9506a032c54a5d1833fef1fe0ce46b6f84ee7534
9b2f3159d474b368aa9a676d5ba6a010c6971166000356dd0374a2df41100570
+ 10 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/210907-ml4pgscdb6/
Unpacked files
SH256 hash:
9294b0b2eab8d14aade842d1428b43f56d4bfade1e55ce1dad248c61a919a218
MD5 hash:
9907e0c146ad96e2b416809466b9378b
SHA1 hash:
22f9f9de1eada6665f2a916c09446fd64a9b5c02
Link:
https://www.unpac.me/results/e8ff6900-da6d-41c0-ab22-79195bbd25e1/
SH256 hash:
561fc13bd3133437c5607e8697add803482e33dd9de9814fc86cc8e13a520b5b
MD5 hash:
4ed1ba2cb9ae7dbc8da5d9c1c0f4e29b
SHA1 hash:
773a68a398a42ace6d05b504b656a40a01da7eca
Link:
https://www.unpac.me/results/e8ff6900-da6d-41c0-ab22-79195bbd25e1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.19
Link:
https://yomi.yoroi.company/submissions/561fc13bd3133437c5607e8697add803482e33dd9de9814fc86cc8e13a520b5b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Embedded_PE
Create hunting rule
Rule name:Embedded_PE
Create hunting rule
Rule name:GoBinTest
Create hunting rule
Rule name:GoBinTest
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 561fc13bd3133437c5607e8697add803482e33dd9de9814fc86cc8e13a520b5b

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1599351/
Cape
Cape
https://www.capesandbox.com/analysis/185997/
  
URLhaus
https://urlhaus.abuse.ch/url/1599413/

Comments