MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fa60303a0c4fd13ecd69e7c1a17788b72605473c2fb3f93eb758010326c76e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5fa60303a0c4fd13ecd69e7c1a17788b72605473c2fb3f93eb758010326c76e5
SHA3-384 hash:	cfaef86e523b7dd737b7f8236d4cb33c9330c06b454304231a8ad8cc72114990f2f02af2bbad8696edb8a99606f236aa
SHA1 hash:	85ef7c03d70e2cc7095550ce15f140e78d05f3ad
MD5 hash:	013eba0050ebe18e39978e89a56c0fab
humanhash:	kitten-chicken-nuts-seventeen
File name:	5fa60303a0c4fd13ecd69e7c1a17788b72605473c2fb3f93eb758010326c76e5
Download:	download sample
Signature	n/a
File size:	5'007'872 bytes
First seen:	2021-01-30 17:05:32 UTC
Last seen:	2021-01-30 18:56:33 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	bc6f6219c69205bfcf9e875060fcd9d1
ssdeep	98304:DPWOtJfIskP639K2Bfm873n1ME5IYrS71FARhPF3a7/nzoy4kKnuaHqrTdL:SOtJfIsw63tjuE5IYrS5u7PFKrOHMxL
Threatray	14 similar samples on MalwareBazaar
TLSH	7436CE50A9C2FC36FCB5B8F2A4167058D414D9782E063306237B6A6A1B77FE01B7639D
Reporter	@JAMESWT_MHT
Tags:	Mingloa

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

143

Origin country :

IT

Mail intelligence

Gathering data

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

5fa60303a0c4fd13ecd69e7c1a17788b72605473c2fb3f93eb758010326c76e5

Verdict:

Malicious activity

Analysis date:

2021-01-30 17:05:54 UTC

Tags:

installer trojan

Link:

https://app.any.run/tasks/184a09fa-75ab-4091-904c-8b31b921504b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/114902/

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Adding a root certificate

Creating a file in the Windows subdirectories

Sending a UDP request

Creating a file in the %AppData% directory

Deleting a recently created file

Reading critical registry keys

Replacing files

Creating a process from a recently created file

Creating a process with a hidden window

Creating a file in the %temp% directory

Creating a file

Sending an HTTP GET request

Running batch commands

Launching a process

Stealing user critical data

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.spyw.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/594625

Signature

Detected unpacking (creates a PE file in dynamic memory)

Installs new ROOT certificates

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/5fa60303a0c4fd13ecd69e7c1a17788b72605473c2fb3f93eb758010326c76e5/

ReversingLabs TitaniumCloud Win32.Trojan.Phonzy

Threat name:

Win32.Trojan.Phonzy

Alert

Create hunting rule

Status:

Malicious

First seen:

2021-01-21 10:24:25 UTC

File Type:

PE (Exe)

Extracted files:

40

AV detection:

22 of 46 (47.83%)

Threat level:

  5/5

Threatray malicious

Verdict:

malicious

Similar samples:

0acebaf80946be0cb3099233e8807aa775c8304fc3dee48d42241ff68b7ab318

2870f899f2e9ec540da321f603cfb1a735dcd06df016718e663dc78fefdf5e0a

344b323928698d9982c7577e5405a1cb587c45f94a0f6745827648381397f255

5b2f060f1512100a0d500312fa579cdad9d3ea101778838173aa7215cd39700a

6d2db66a98ec5730bdcbc41dc7c78210fe24fe48bf7e44b59ab01c2084900456

7a79f0c95e891b939e275fa19e641b676f2eb70471945fb3b15d6a649cafe071

8794893f687e487bfafaf085154a5b932612d9de0825a3b392931d414b2c1985

a8fefe8e1f92a30d1cdd4e2e2afaacf08a02c8961f496ee16e89062417ec5f28

f245e9b94930c77f626bdc4d74f7d03f48557cb206175876da42033186da6410

fa3b184df1f3b9ed637a7f8f9c557dca6871c7f150badb172947809bddf1c6d0

+ 4 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

spyware

Link:

https://tria.ge/reports/210130-5mjcamy55n/

Behaviour

Checks SCSI registry key(s)

Modifies system certificate store

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Nirsoft

UnpacMe win_9002_g0

Unpacked files

SH256 hash:

b00af7b84651725bc4b2ac9a05f78a1913869d09563b20f56fb1536dbeef35d8

MD5 hash:

4f01d45a598ba53a2820bff6ff8e16be

SHA1 hash:

08c72e664d1594a9bc02417e2a01c61b0b876397

Link:

https://www.unpac.me/results/0680b6f4-4caf-4cb4-bdaa-6c212fd9fcaf/

SH256 hash:

c0dda4bbf2986f7b4e39a41a44b04217d823275695c18db47f50f841aeadb6c5

MD5 hash:

db9efb5b07b51da66b17cc0e36447ffd

SHA1 hash:

2808c7e9bcdd67128570c7d8a5d59eecb7637cda

Detections:

win_9002_g0

Alert

Create hunting rule

Link:

https://www.unpac.me/results/0680b6f4-4caf-4cb4-bdaa-6c212fd9fcaf/

Parent samples :

7a79f0c95e891b939e275fa19e641b676f2eb70471945fb3b15d6a649cafe071
a8fefe8e1f92a30d1cdd4e2e2afaacf08a02c8961f496ee16e89062417ec5f28
6d2db66a98ec5730bdcbc41dc7c78210fe24fe48bf7e44b59ab01c2084900456
2870f899f2e9ec540da321f603cfb1a735dcd06df016718e663dc78fefdf5e0a
344b323928698d9982c7577e5405a1cb587c45f94a0f6745827648381397f255
5fa60303a0c4fd13ecd69e7c1a17788b72605473c2fb3f93eb758010326c76e5
cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
6a9b454b620677ea11f4f69156969468b0f43ebdfe27dabfb0cf16572f9379eb
d6d2e00343a3cad48cc2f4799ce87d27acc3ce154aed286c07f226de2e9c4035

SH256 hash:

a68e1297fae2bcf854b47ffa444f490353028de1fa2ca713b6cf6cc5aa22b88a

MD5 hash:

79cb6457c81ada9eb7f2087ce799aaa7

SHA1 hash:

322ddde439d9254182f5945be8d97e9d897561ae

Link:

https://www.unpac.me/results/0680b6f4-4caf-4cb4-bdaa-6c212fd9fcaf/

SH256 hash:

bd29d2b1f930e4b660adf71606d1b9634188b7160a704a8d140cadafb46e1e56

MD5 hash:

89f6488524eaa3e5a66c5f34f3b92405

SHA1 hash:

330f9f6da03ae96dfa77dd92aae9a294ead9c7f7

Link:

https://www.unpac.me/results/0680b6f4-4caf-4cb4-bdaa-6c212fd9fcaf/

SH256 hash:

c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb

MD5 hash:

ca2f560921b7b8be1cf555a5a18d54c3

SHA1 hash:

432dbcf54b6f1142058b413a9d52668a2bde011d

Link:

https://www.unpac.me/results/0680b6f4-4caf-4cb4-bdaa-6c212fd9fcaf/

SH256 hash:

c5546c63e9f72c415143ac85cf32bf48eb9ff8269465282c792f2b17cad59a65

MD5 hash:

3b01e45b211d498bd3745b5e63fd1776

SHA1 hash:

8d80d01e54a1161f04d007b6f6ee36d22450f8b4

Link:

https://www.unpac.me/results/0680b6f4-4caf-4cb4-bdaa-6c212fd9fcaf/

SH256 hash:

66b2acfb5c526c869a68649d96eb90495226a0c46855a0296f74ce1dae8e966e

MD5 hash:

1e14873c6f50d5094f5aa6f4a3a8e9a1

SHA1 hash:

91a91dea091e3f0ac7ce61cd0cfa1ced98da0846

Link:

https://www.unpac.me/results/0680b6f4-4caf-4cb4-bdaa-6c212fd9fcaf/

SH256 hash:

6c483cbe349863c7dcf6f8cb7334e7d28c299e7d5aa063297ea2f62352f6bdd9

MD5 hash:

a94dc60a90efd7a35c36d971e3ee7470

SHA1 hash:

f936f612bc779e4ba067f77514b68c329180a380

Link:

https://www.unpac.me/results/0680b6f4-4caf-4cb4-bdaa-6c212fd9fcaf/

SH256 hash:

55830708fff87877f0a0a901342dbac35842fb6481dffb8e7d7e74de80792c5a

MD5 hash:

7545bd5623e363791d1b039b2123b5b8

SHA1 hash:

fcd1d9889113fe0c86a5b8c60bce90261e0d0936

Link:

https://www.unpac.me/results/0680b6f4-4caf-4cb4-bdaa-6c212fd9fcaf/

SH256 hash:

5d2abd9fbb2b0cc96824c292eaf79fed03cf41d063a810c5b73e1c115cf9c00a

MD5 hash:

5a1a4eb53b6ca78aefc814f4024e3511

SHA1 hash:

8c22a426c4b5ce82f4058d1ea53c1f110d2ea7e6

Link:

https://www.unpac.me/results/0680b6f4-4caf-4cb4-bdaa-6c212fd9fcaf/

SH256 hash:

5fa60303a0c4fd13ecd69e7c1a17788b72605473c2fb3f93eb758010326c76e5

MD5 hash:

013eba0050ebe18e39978e89a56c0fab

SHA1 hash:

85ef7c03d70e2cc7095550ce15f140e78d05f3ad

Link:

https://www.unpac.me/results/0680b6f4-4caf-4cb4-bdaa-6c212fd9fcaf/

VirusTotal 43.66%

AV coverage:

43.66%

AV detections:

31 / 71

Link:

https://www.virustotal.com/gui/file/5fa60303a0c4fd13ecd69e7c1a17788b72605473c2fb3f93eb758010326c76e5/detection/f-5fa60303a0c4fd13ecd69e7c1a17788b72605473c2fb3f93eb758010326c76e5-1611250385

YOROI YOMI Tinba

Threat name:

Tinba

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5fa60303a0c4fd13ecd69e7c1a17788b72605473c2fb3f93eb758010326c76e5

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/114902/