MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6623d3bb74ec56148b4bfb75277142eba255f0613fb9f2eb510b27e985f1c7fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6623d3bb74ec56148b4bfb75277142eba255f0613fb9f2eb510b27e985f1c7fd
SHA3-384 hash: 69667036994965c7556d2c0c966df9ea6cabe97bb2268c00f41e1c492c41143ac7c06be6a9d77332de6fc944367f34d7
SHA1 hash: 01486410acdcf33e32f8e6cceaa2b2f6a8a188d5
MD5 hash: 9de44c8a9d946dd4f1658f12996e7b59
humanhash: winter-pluto-wolfram-ten
File name:769a374b19da639f1bb2b4e24b368065
Download: download sample
File size:5'429'248 bytes
First seen:2020-11-17 11:29:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4ddbbed1e26baed238de562826f1176f
ssdeep 98304:QF7PrqWFJaE1utqQXgKwISbjfdCgXe9dF4HYqt767jHd+VS6qoCX5QEehZjzNvM:kvqWFAkEqQt1SbjS9deHYcG7EVS6qoq
Threatray 28 similar samples on MalwareBazaar
TLSH E44601366760149CDCA77BF5A9271FF22AF1BD2DC102B9372FD5378488768A4A613342
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6623d3bb74ec56148b4bfb75277142eba255f0613fb9f2eb510b27e985f1c7fd/
Threat name:
Win32.Trojan.CozyDuke
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 11:30:19 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270
22a49fd2468178e5b33cad08985adde50f0530a33260affc58bee6b2401005a9
2aaad8177d08507b09dc3d419b4d31f65db6fe6bc6314ffce650b9fc57f0817c
2ace0be70434934b6e140f679a0c1551dd589abedfb1f6abeb5ceffaf0a1b9d9
2c9e0f6e90b663293874332acd2cab44b8a28011337c99e828e86e3b9d1585c2
3e5bbf9fcae918011ec4eee75ac6402fddf20d09fef95b362d0e226d56b80f1d
44e717206bba160f62320de53005a05ba4a4f51063b81503747197e0497b17ce
530f50165d1fb4cafed8e7f61648c0924b225d5b7744a9ee6f2a86dbbb1c7c9b
84783081ade87f5a4a1902a275eb66c7fe8ebef9e43cdd2d4527bdb1a5a51f04
a3c2207806f9be710f3a1d1cbf1149a708bb080946e2368c8e826f5cef2293e4
+ 18 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
vmprotect
Link:
https://tria.ge/reports/201117-s1eykfjy4e/
Unpacked files
SH256 hash:
6623d3bb74ec56148b4bfb75277142eba255f0613fb9f2eb510b27e985f1c7fd
MD5 hash:
9de44c8a9d946dd4f1658f12996e7b59
SHA1 hash:
01486410acdcf33e32f8e6cceaa2b2f6a8a188d5
Link:
https://www.unpac.me/results/9da20b56-dcec-440f-afcb-24281f35b352/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments