MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c6e6b2ac1dd3b79f6bd5de563d90e9614d75a2f33dbde962dd708242e6eb1b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c6e6b2ac1dd3b79f6bd5de563d90e9614d75a2f33dbde962dd708242e6eb1b8
SHA3-384 hash: 0dcdce67050b9275f4853b903b161ab8999b8521a526cc48f1a71a978e7f6a62fbebcbb83aa1b8167bf241d02472d6e5
SHA1 hash: 41b4990ef307bfd74f76dad742f3c81c8e7fc686
MD5 hash: b8eb7cafef258d75d3043c624927fc10
humanhash: crazy-speaker-black-november
File name:5c6e6b2ac1dd3b79f6bd5de563d90e9614d75a2f33dbde962dd708242e6eb1b8
Download: download sample
File size:1'353'232 bytes
First seen:2020-06-03 08:57:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ef471c0edf1877cd5a881a6a8bf647b9 (83 x Formbook, 33 x Loki, 31 x Loda)
ssdeep 24576:bq5TfcdHj4fmbpD2qK+Vf3oVGUG5y6zl8O3uXWVpA4yozB1Q:bUTsamRxHf3oVGUGfuXYAx
Threatray 949 similar samples on MalwareBazaar
TLSH 68559E1527E88B54E1BE9B7844B1450103F2BD42D62AE35D3EEC70EE3F327858A56367
Reporter raashidbhatt
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

Win.Dropper.Miner-7086571-0
Create hunting rule

PUA.Win.Malware.Cheathappens-6718287-0
Create hunting rule

PUA.Win.Downloader.Downloadsponsor-6804660-0
Create hunting rule

PUA.Win.Downloader.Downloadsponsor-7191603-0
Create hunting rule

PUA.Win.Downloader.Downloadsponsor-7191606-0
Create hunting rule

PUA.Win.Tool.Ocna-7192091-0
Create hunting rule

PUA.Win.Downloader.Downloadsponsor-7288181-0
Create hunting rule

PUA.Win.Downloader.Downloadsponsor-7334712-0
Create hunting rule

PUA.Win.Downloader.Downloadsponsor-7395323-0
Create hunting rule

PUA.Win.Downloader.Downloadsponsor-7850350-0
Create hunting rule

Gathering data
Threat name:
Win32.PUA.Downloadsponsor
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 04:29:30 UTC
AV detection:
33 of 48 (68.75%)
Threat level:
  1/5
Verdict:
malicious
Similar samples:
07b55ae89038136fc1da21d2aaea7b9e6d17ea18843d26f9bbcad7124eb5f1be
1656c8b0d2cf6a2c990f87b2774a242cccc62ce6b9cd725cc5d5b3ef46585734
1be97fde78848d5f414a09d31b63a422e30404d787a5467edede763c73e0bbbd
5c1ef7cfd4682402744f14978af8383c9153e52db9ecf4926596b898f1dd32da
68dfd4d506b49f1ac0345d9507835df35a25aca5df2fb52396e66af443f9feca
782fa714fdc51cee0a898e99f98093833524a280d11dbe52aa74b4e18b37262c
98011c4066f47e8f3628772faeae182566a68c9829eb9206b04115b307c42f5a
bd49dbc39747130c1e76ad9ce9579a8d4fe5ea95ef5ade5568db2b398c072327
dfdf0f99d16bd7eb45ba5c6250fd49e81c99d41cd443bab3723ad9cdfb8b3a0f
e9fc4844ee50f9e59616bd7238bfae3de6b8b194abf635e787e5a44d8658fe42
+ 939 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery upx
Link:
https://tria.ge/reports/201109-gbhyyfpjgn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: GetForegroundWindowSpam
Checks installed software on the system
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments