MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5779383242bc52dd737295a5f802288cb19bb3d44a8f85c3c0a806c99d6e215d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5779383242bc52dd737295a5f802288cb19bb3d44a8f85c3c0a806c99d6e215d
SHA3-384 hash: f15b2f7c46d69abd002c3c5dbba87563835dd04040dc1654eddaa792896ed24875cf5f4b4c377ca2c8c38a3c883d1257
SHA1 hash: 48d793f37f94a36719924f7c25ef457db324f317
MD5 hash: 963f32e94b96b222adf71515e1087b61
humanhash: golf-kansas-solar-cola
File name:hamnab.exe
Download: download sample
File size:770'986 bytes
First seen:2021-02-08 20:56:22 UTC
Last seen:2021-02-08 22:51:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b4fde864c45f66c378efc2bedd98550f (17 x BazaLoader)
ssdeep 3072:y53EU0uzG0pwuOHPqvmx5tvqurow0EYjoavXPnWMlxkfC:8L/sqUdjr95YjomXUf
TLSH C6F46B5BB2E438F8E066D630D9D04205EBB1743517758FBF03E88295AF53AA1AD6DB30
Reporter James_inthe_box
Tags:exe signed

Code Signing Certificate

Organisation:Google LLC
Issuer:DigiCert Assured ID Code Signing CA-1
Algorithm:sha1WithRSAEncryption
Valid from:2019-11-08T00:00:00Z
Valid to:2022-11-16T12:00:00Z
Serial number: 06aea76bac46a9e8cfe6d29e45aaf033
Intelligence: 16 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 5f2f2840c6e51d17f09334ada05d9dcdd9aeeb11af0ae163816757d539abe3ee
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
hamnab.exe
Verdict:
No threats detected
Analysis date:
2021-02-08 20:58:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/10004b6e-313f-4092-97e4-52fa78a6afbe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/116104/
Detection(s):
PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Launching a process
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/602313
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 350175 Sample: hamnab.exe Startdate: 08/02/2021 Architecture: WINDOWS Score: 64 65 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->65 67 Uses ping.exe to sleep 2->67 69 Machine Learning detection for sample 2->69 71 Uses ping.exe to check the status of other devices and networks 2->71 11 hamnab.exe 2->11         started        13 qheqemlc.exe 2->13         started        15 qheqemlc.exe 2->15         started        process3 process4 17 cmd.exe 1 11->17         started        dnsIp5 59 127.0.0.1 unknown unknown 17->59 73 Uses ping.exe to sleep 17->73 21 hamnab.exe 3 17->21         started        24 conhost.exe 17->24         started        26 PING.EXE 1 17->26         started        signatures6 process7 file8 55 C:\Users\user\AppData\Local\...\qheqemlc.exe, PE32+ 21->55 dropped 57 C:\Users\...\qheqemlc.exe:Zone.Identifier, ASCII 21->57 dropped 28 cmd.exe 1 21->28         started        31 cmd.exe 1 21->31         started        33 cmd.exe 1 21->33         started        process9 signatures10 77 Uses ping.exe to sleep 28->77 35 qheqemlc.exe 28->35         started        39 PING.EXE 1 28->39         started        41 conhost.exe 28->41         started        43 conhost.exe 31->43         started        45 reg.exe 1 1 31->45         started        47 conhost.exe 33->47         started        process11 dnsIp12 61 34.210.71.206, 443, 49728, 49748 AMAZON-02US United States 35->61 75 Machine Learning detection for dropped file 35->75 49 cmd.exe 1 35->49         started        63 192.168.2.1 unknown unknown 39->63 signatures13 process14 process15 51 conhost.exe 49->51         started        53 reg.exe 1 49->53         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5779383242bc52dd737295a5f802288cb19bb3d44a8f85c3c0a806c99d6e215d/
Threat name:
Win64.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 20:55:56 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210208-ybh4dpznyj/
Behaviour
Runs ping.exe
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
5779383242bc52dd737295a5f802288cb19bb3d44a8f85c3c0a806c99d6e215d
MD5 hash:
963f32e94b96b222adf71515e1087b61
SHA1 hash:
48d793f37f94a36719924f7c25ef457db324f317
Link:
https://www.unpac.me/results/021929dc-4fdf-4df6-b2d0-20682ff694cd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5779383242bc52dd737295a5f802288cb19bb3d44a8f85c3c0a806c99d6e215d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/116104/

Comments