MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b322305e118616a76353a8dbd4ada3c0fa9af6c7a1a30ecce7ad87b47d88522. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b322305e118616a76353a8dbd4ada3c0fa9af6c7a1a30ecce7ad87b47d88522
SHA3-384 hash: c7b18d4fa5660c6db8d23459b3d0ded009433d3d9c3489e3f119632e373d2176d4741a0a432cac3f50f922729d222204
SHA1 hash: 8c4fb9f8a6fffa8748fcdc74017a4781a5d61716
MD5 hash: 11a7ff372d40b3896f184cc9e0075265
humanhash: rugby-uncle-tango-dakota
File name:8server.exe
Download: download sample
File size:422'912 bytes
First seen:2021-02-10 08:47:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 83eceaca031d4cfad850d3c83a2f5ed1
ssdeep 6144:AqhO580Ub4qfEE6XGsM7Zje3pI89WoFO+hx/JEax3/fs0:Aqksb4qfEE6X9M7lSy+nGaxvfs0
Threatray 19 similar samples on MalwareBazaar
TLSH EE94CE83BB54E845D57116B809AAC6F95B25BC983930CB0B2AF8FE1FBD32911DC65313
Reporter r3dbU7z
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8server.exe
Verdict:
No threats detected
Analysis date:
2021-02-10 08:57:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/07402214-bd18-4c74-a7f3-87c37c6d584b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/116461/
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

Win.Dropper.LokiBot-8354609-0
Create hunting rule

Win.Dropper.LokiBot-8354646-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/604112
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 351054 Sample: 8server.exe Startdate: 10/02/2021 Architecture: WINDOWS Score: 56 10 Antivirus / Scanner detection for submitted sample 2->10 12 Multi AV Scanner detection for submitted file 2->12 6 8server.exe 1 2->6         started        process3 process4 8 8server.exe 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5b322305e118616a76353a8dbd4ada3c0fa9af6c7a1a30ecce7ad87b47d88522/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2021-02-10 08:48:12 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0f81f4eb37083c821598ffd57cff12a082f19ca2de57c86faff65755ef332686
15e3107a2c30da16832db6f9cdadd38c7a202d72b6a43899b9642d3b695d6f50
24ed6ee6c21b01723299773311912048f6a4a782de9496c6e479c22d6fceb085
39016358b939b83cf9997c447458ae2d13186c3f66e66784c9e8ff4031b60c7e
4e0d1edb76747fd945b87dd18299298f0df719edbea946119d91db59a9b6527a
7d809e8c9b98c16647bbfac49854c28ecc3fe6d4345410deeaa79445cc50cf51
a42ccf420298ede753f0b4da8e04c3b0dd963fa627efd5c2994b1e3f4093d797
b3302c4a9fd06d9fde96c9004141f80e0a9107a9dead1659e77351f1b1c87cf6
dac7b64601ffa3176296bc0647aa7cd30c50b95ea5002410000439ce506b5b9e
f40b9e6f7cfed63bba3b6eae6b0403ab26906caa77830027ed39a05918c4b877
+ 9 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
ransomware upx
Link:
https://tria.ge/reports/210210-1ap5c1edt6/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Unpacked files
SH256 hash:
c1e16fb7c902f0e35b30a7039b7ae8039db835b83746220c32c55bcfa2145a9e
MD5 hash:
fa1c9e083c7ce094013984ef2487da96
SHA1 hash:
be4b4a423400c8bc08e37d7d2283f155043f5000
Link:
https://www.unpac.me/results/5816cf8e-e115-4518-b216-012a153800ba/
SH256 hash:
5b322305e118616a76353a8dbd4ada3c0fa9af6c7a1a30ecce7ad87b47d88522
MD5 hash:
11a7ff372d40b3896f184cc9e0075265
SHA1 hash:
8c4fb9f8a6fffa8748fcdc74017a4781a5d61716
Link:
https://www.unpac.me/results/5816cf8e-e115-4518-b216-012a153800ba/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5b322305e118616a76353a8dbd4ada3c0fa9af6c7a1a30ecce7ad87b47d88522

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/116461/

Comments