MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f9a6c0b4bdd4bf26f9b8907914cbf0e88a3d780275a4e5738bf1f2ef02ce37e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f9a6c0b4bdd4bf26f9b8907914cbf0e88a3d780275a4e5738bf1f2ef02ce37e
SHA3-384 hash: 3dbae156f3c57e5b0fdfef2cf92a392d3537f4fb6d33eeafd2369401e430b517a4dc276fec348222135e59e350118b98
SHA1 hash: 33eeeaf2487b06335411f94a1035e20e655936ec
MD5 hash: fdd9a44f07b7ecc266995584cd0666a6
humanhash: mississippi-black-blue-winter
File name:5f9a6c0b4bdd4bf26f9b8907914cbf0e88a3d780275a4e5738bf1f2ef02ce37e
Download: download sample
File size:2'453'504 bytes
First seen:2022-08-03 10:28:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 516a7ee1ea18e78c2426dd594173d49a
ssdeep 49152:ZaMB2q7+d1AApkwXErmOEjK+URN5gEikHawf3wl:Zloqqd1A+kwXRO07UjHawf3wl
Threatray 14'020 similar samples on MalwareBazaar
TLSH T10FB501A6F944AD37D03106F0A59785ECD6727DE41E21C13F22B4735EBEB22E41E36292
TrID 38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.0% (.EXE) Win64 Executable (generic) (10523/12/4)
8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 6327161b1b1b4908
Reporter JAMESWT_WT
Tags:exe Hangzhou Saifan Technology Co. Ltd.

Intelligence

File Origin
# of uploads :
1
# of downloads :
298
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5f9a6c0b4bdd4bf26f9b8907914cbf0e88a3d780275a4e5738bf1f2ef02ce37e
Verdict:
Suspicious activity
Analysis date:
2022-08-03 10:30:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3bf57c3d-79f3-47a5-a9a2-8833a5d45762

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/296153/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the Windows directory
Enabling the 'hidden' option for recently created files
Creating a service
Launching a service
Loading a system driver
Creating a file in the Windows subdirectories
Enabling autorun for a service
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger packed
Link:
https://www.filescan.io/uploads/62ea4e32b7eec6562787db0d/reports/9be0b77d-f730-448e-8c6e-54c730c05662/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b3b132d5-40cb-42da-bb37-11e8ad880072
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1045531
Signature
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Detected unpacking (changes PE section rights)
Found driver which could be used to inject code into processes
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Sample is not signed and drops a device driver
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f9a6c0b4bdd4bf26f9b8907914cbf0e88a3d780275a4e5738bf1f2ef02ce37e/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-06-05 06:19:16 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l6ngyc2l3vf7e343redzctf7b2ekhv4ae5ne4vzyx4ps54bm4n7a._file
Verdict:
unknown
Similar samples:
1e857555be92a0e4bfa8c0e5dc5b7b91a08e6daea0036e3bf23d3d3de79e495f
2dc810c540787f600ba073fcc3966102a266d867938861c3ac3da38dd7c004fa
5450806ae37bf26fc3d0db2190b03f0d74c032c3f9a2c91b7870e354992c6e35
7b483b575f88d063ec7d84405be25d5d29579133e9951e5f7b5e2b0d9632472f
8ec16e4c4fd0a80322418ea661e4dd3b427f7369078d85f64069588624752bdc
97bd84d68cdb1c875b45f735ab621aed8a0c717e56a7c8337532dabcad5c20a6
9c7feb98fb5804f1f80dd03db1f84a06b68ea6043d2d34ab53edce82b83827b2
9f665e80fd30880ad8a4e5955dcc7159d05d89dbaa691d7e4d162d402952b4e9
df50e9ae62a46bda93ff03d76b707d574a3803754a782e21e4b9ef547f7ca32e
ecf763f4bacb053f371a3c84421af642694013c2a3ed2a451c8269b1ab2d71ca
+ 14'010 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/220803-mh8t2aaag6/
Behaviour
Suspicious behavior: LoadsDriver
Suspicious use of SetWindowsHookEx
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Unpacked files
SH256 hash:
5f9a6c0b4bdd4bf26f9b8907914cbf0e88a3d780275a4e5738bf1f2ef02ce37e
MD5 hash:
fdd9a44f07b7ecc266995584cd0666a6
SHA1 hash:
33eeeaf2487b06335411f94a1035e20e655936ec
Link:
https://www.unpac.me/results/d8409032-00e7-40ce-8f2f-7bd01115a987/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/5f9a6c0b4bdd4bf26f9b8907914cbf0e88a3d780275a4e5738bf1f2ef02ce37e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/296153/

Comments