MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57aa81416cfdbd76df2a15cb14810f8529ecab0eea978210a4ef3047f35a225e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57aa81416cfdbd76df2a15cb14810f8529ecab0eea978210a4ef3047f35a225e
SHA3-384 hash: 02a2093829eabf03a8d749a526c193c52d4a045b264fd001e4e8b1ef16f73712b820a828a62b3f3406ccecb26e685702
SHA1 hash: ce40442d708451a0453d390b12d4566bc59345d3
MD5 hash: 8bec74cc5d6a448ec6c38f699d57b5cd
humanhash: island-don-mobile-utah
File name:57aa81416cfdbd76df2a15cb14810f8529ecab0eea978210a4ef3047f35a225e
Download: download sample
File size:2'546'551 bytes
First seen:2020-06-03 09:12:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 98f67c550a7da65513e63ffd998f6b2e (21 x SnakeKeylogger, 13 x MassLogger, 11 x CryptOne)
ssdeep 49152:cYQ3fCMSRSafhRoS8EO8fJhiLa0KHBXZ0Zi1P71xN9co9X5I1WS:ZQ3fCMSRSafhRoS8EO8fJhsa0KhJ0aPe
Threatray 378 similar samples on MalwareBazaar
TLSH 4CC54B12E301D51AE8A384F0151AD7BAAD347F302945A583B3C5BF6D7B702F2AA2571F
Reporter raashidbhatt
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Win.Virus.Sality
Create hunting rule

Win.Trojan.VBGeneric-6735885-0
Create hunting rule

Win.Virus.Sality-6747602-0
Create hunting rule

Win.Malware.Swisyn-7610491-0
Create hunting rule

Win.Malware.Swisyn-7610494-0
Create hunting rule

Win.Trojan.Kazy-304
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Swisyn
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 04:29:39 UTC
AV detection:
46 of 48 (95.83%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
022f0b568430e7eab1768682c462b5d811e5510a266a562adeb567215d6ef897
3816c271634e3a2861904c643e3f82fcc3e50ce185394dae41b69e13e0165a95
4387ac7995e6dfd469ee49ddafe67654b6672545775ac30544e94dde4452bc6d
54c9ce578a123b2abbcb00af7638f3d1c93041959ebccf3981a099a869c5a171
55a96dd92207c640127fb5f7efd5bdc352eb740f134f22b37eb3292abf8c337a
a1ca46a8c41e45116351ecd3926bca9bc16b95a2aacecc100a7c62716e8f1274
c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682
dedad3d7a97da9f0103dd87d86a422e38f581879c41ab07594d141eb303d2de9
e2784c7f18addfe3cf107b35eae017eb8d02025fec8bc9d235a7ba598fcd9b62
eaab0de271ab0a0a59a3db2c79ec4e0b9c6f645d4c49bb0deadb3c3469fb19a8
+ 368 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence
Link:
https://tria.ge/reports/201109-9xzyqb4ksa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Modifies service
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Modifies Installed Components in the registry
Modifies WinLogon for persistence
Modifies visiblity of hidden/system files in Explorer
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments