MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58fb11e7f6601b43803edff4369c27d9e26323f913ab76889df528c34f2dc525. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TA505


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58fb11e7f6601b43803edff4369c27d9e26323f913ab76889df528c34f2dc525
SHA3-384 hash: 96fb84d6ff26eeee2bd36c191303cbd1d1c33cebd25de0f43b22213568d49a5de074385ed2681991eb0241d22fdfe7a3
SHA1 hash: cb74dd7a7fa9432b79ff2c6181574be550ca9c51
MD5 hash: 544bb245dd82bfeaebf6d632ab56995e
humanhash: nine-september-butter-alabama
File name:str_join1.bin
Download: download sample
Signature TA505
Create hunting rule
File size:381'440 bytes
First seen:2020-09-08 11:16:34 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash a6c692d5595835045966424d2e96b2f2 (1 x TA505)
ssdeep 6144:TqAu5hRAh3eRKoDerVRkijth5nulW4x2WILLfYplRPm0MIXoHta:45hOy7/ijbdu3x2WOfg8FIXoNa
TLSH 1484F156BBC3D074D4D7803994609E2D07BB8EA73F2468678F440ADE8DA5BC225AF731
Reporter JAMESWT_WT
Tags:32bit dll TA505

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/57857/
Detection(s):
SecuriteInfo.com.Mal.EncPk-OJ.24377.14028.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58fb11e7f6601b43803edff4369c27d9e26323f913ab76889df528c34f2dc525/
Threat name:
Win32.Trojan.GraceWire
Create hunting rule
Status:
Malicious
First seen:
2020-09-08 11:16:20 UTC
File Type:
PE (Dll)
Extracted files:
2
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ld5rdz7wmanuhab6372dnhbh3hrggi7zcovxnce56uumgtznyusq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200908-82r94zpct2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Blacklisted process makes network request
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/58fb11e7f6601b43803edff4369c27d9e26323f913ab76889df528c34f2dc525

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/57857/

Comments