MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2
SHA3-384 hash: 5201a34da6998897ed007e3baf7b81f25b3a4221f85e252a7c269e5bfb05a808f3536ca160984ec5ece946683a434770
SHA1 hash: 152189b62c546d6297a7083778fba62dcec576be
MD5 hash: 967fcf185634def5177f74b0f703bdc0
humanhash: pizza-autumn-yellow-friend
File name:Russian APT29 (2)
Download: download sample
File size:428'032 bytes
First seen:2020-07-17 05:12:45 UTC
Last seen:2020-07-17 06:02:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash daf2da52475fd8981b19ec3c321a983c
ssdeep 6144:AC70wZI2ZhjKOYTvkh+YVSn9bEAMpNZr3qHLAONXGCSxfuMBES:/lZIpQoYVmZERH0LguMWS
Threatray 267 similar samples on MalwareBazaar
TLSH 0794B2A16DC9803DF06A24392B3CAA7345A87F200694FFC7D398573D8E64BB157A3752
Reporter JAMESWT_WT
Tags:APT29

Intelligence

File Origin
# of uploads :
2
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/27181/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Launching a process
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Running batch commands
Launching the process to interact with network services
Searching for the window
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/388908
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Whoami Execution
Uses ipconfig to lookup or modify the Windows network settings
Uses whoami command line tool to query computer and username
Writes or reads registry keys via WMI
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 246638 Sample: Russian APT29 (2) Startdate: 18/07/2020 Architecture: WINDOWS Score: 88 49 Multi AV Scanner detection for dropped file 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 Machine Learning detection for sample 2->53 55 4 other signatures 2->55 8 Russian APT29 (2).exe 6 2->8         started        process3 file4 45 C:\Users\user\AppData\...\SangforUPD.exe, PE32 8->45 dropped 47 C:\Users\...\SangforUPD.exe:Zone.Identifier, ASCII 8->47 dropped 11 systeminfo.exe 1 1 8->11         started        14 net.exe 1 8->14         started        16 cmd.exe 1 8->16         started        18 6 other processes 8->18 process5 signatures6 63 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->63 65 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 11->65 67 Writes or reads registry keys via WMI 11->67 20 conhost.exe 11->20         started        22 net1.exe 1 14->22         started        25 conhost.exe 14->25         started        27 conhost.exe 16->27         started        29 conhost.exe 18->29         started        31 conhost.exe 18->31         started        33 conhost.exe 18->33         started        35 2 other processes 18->35 process7 signatures8 37 conhost.exe 20->37         started        39 conhost.exe 20->39         started        41 net1.exe 1 20->41         started        57 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 22->57 59 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 22->59 61 Writes or reads registry keys via WMI 22->61 43 conhost.exe 27->43         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2/
Threat name:
Win32.Spyware.DarkHotel
Create hunting rule
Status:
Malicious
First seen:
2020-01-24 14:34:09 UTC
File Type:
PE (Exe)
Extracted files:
13
AV detection:
37 of 48 (77.08%)
Threat level:
  2/5
Verdict:
suspicious
Similar samples:
160891f5b2c1cc10c57f0351d6ee2bec92b11462e3b940771bc90c762332b97d
1b2094d2d7015ce59416ddaf7a827d03837bde54a330dc5600ceac3f91799559
1f1d87aaf919fc57a2e4498d3d54c8f9c724026b97b05747e1e6bdcccb51be46
22f529d68ea62a081c6f7c33637bd901e5775c0fd48f7934334607c350e2fff2
65495d173e305625696051944a36a031ea94bb3a4f13034d8be740982bc4ab75
6a05d4932003ec27bc62ed01bd92e39282482c8c6c4f74e55e2ad3385893fbe1
8d8c8b5b053f50f42f5898af8a18772302017b5ac88f99d6e6e18d21c87ee784
91e462bedfc07bf6a3ef8d29aa240925cb9a31335c090bc92c0f5672307b72ee
a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064
c45cbf7de196d50a6eb860e3d8dbfdf8f3699c3e62df58f63bd1c6c176c9ead1
+ 257 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200717-h9ahb75ylj/
Behaviour
Gathers network information
Runs net.exe
Enumerates processes with tasklist
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Gathers system information
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Gathers system information
Gathers network information
Runs net.exe
Enumerates processes with tasklist
Modifies service
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/27181/

Comments