MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5eb285443b7b9ab49c8b73112f66813eacc811d752e294fd2ca8db89da49589d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DiskWriter


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5eb285443b7b9ab49c8b73112f66813eacc811d752e294fd2ca8db89da49589d
SHA3-384 hash: b7d45bca2b605cf0672ee142a285559ffbb77604ec7d93cf73f3b7052acd31761cedf085fe0f50eb885c1329c926c5e6
SHA1 hash: d0d2cd4e6de3314a61df6519e89600e6ea43dce7
MD5 hash: 51b94137e88771042db62d5f1038dc58
humanhash: fifteen-march-lithium-magnesium
File name:Dubi助手[已更新].exe
Download: download sample
Signature DiskWriter
Create hunting rule
File size:5'726'208 bytes
First seen:2020-10-03 01:37:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4bf101810afeacb199010cf5f5502a7d (1 x DiskWriter)
ssdeep 98304:CLJHXOmVpqLHrp1j7C0YuUqeqvY8qVgHm+PQsUmRZn72F8fnir4YaW:fmVpqxo06Y9GQnqh
TLSH FF4623734374010EF4E6CC3C8B2BBDF532F70B568B41A87A699AA5E529215A4F633D13
Reporter vm001cn
Tags:DiskWriter MBRLock

Intelligence

File Origin
# of uploads :
1
# of downloads :
253
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/67867/
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.32018.25061.4278.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Windows shutdown
Low-level writing
Rewriting of the hard drive's master boot record
Result
Threat name:
Unknown
Detection:
malicious
Classification:
phis.evad
Score:
63 / 100
Link:
https://www.joesandbox.com/analysis/480685
Signature
Adds a new user with administrator rights
Antivirus / Scanner detection for submitted sample
Infects the boot sector of the hard disk
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Overwrites the password of the administrator account
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes directly to the primary disk partition (DR0)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 292783 Sample: Dubi#U52a9#U624b[#U5df2#U66... Startdate: 03/10/2020 Architecture: WINDOWS Score: 63 32 Antivirus / Scanner detection for submitted sample 2->32 34 Multi AV Scanner detection for submitted file 2->34 36 Machine Learning detection for sample 2->36 38 3 other signatures 2->38 7 Dubi#U52a9#U624b[#U5df2#U66f4#U65b0].exe 4 2->7         started        process3 file4 30 \Device\Harddisk0\DR0, ID=0xee, 7->30 dropped 40 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->40 42 Writes directly to the primary disk partition (DR0) 7->42 44 Overwrites the password of the administrator account 7->44 46 2 other signatures 7->46 11 net.exe 1 7->11         started        14 net.exe 1 7->14         started        16 net.exe 1 7->16         started        signatures5 process6 signatures7 48 Overwrites the password of the administrator account 11->48 18 conhost.exe 11->18         started        20 net1.exe 1 11->20         started        22 conhost.exe 14->22         started        24 net1.exe 1 14->24         started        26 conhost.exe 16->26         started        28 net1.exe 1 16->28         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5eb285443b7b9ab49c8b73112f66813eacc811d752e294fd2ca8db89da49589d/
Threat name:
Win32.Trojan.DiskWriter
Create hunting rule
Status:
Malicious
First seen:
2020-10-02 17:43:32 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Verdict:
suspicious
Result
Malware family:
n/a
Score:
  9/10
Tags:
bootkit persistence ransomware
Link:
https://tria.ge/reports/201003-t28dwtaawa/
Behaviour
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies data under HKEY_USERS
Writes to the Master Boot Record (MBR)
Modifies WinLogon to allow AutoLogon
Grants admin privileges
Unpacked files
SH256 hash:
5eb285443b7b9ab49c8b73112f66813eacc811d752e294fd2ca8db89da49589d
MD5 hash:
51b94137e88771042db62d5f1038dc58
SHA1 hash:
d0d2cd4e6de3314a61df6519e89600e6ea43dce7
Link:
https://www.unpac.me/results/0c8c12cb-5b24-4608-b2f4-dcf3e27a16d5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
FlyStudio
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5eb285443b7b9ab49c8b73112f66813eacc811d752e294fd2ca8db89da49589d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/67867/

Comments