MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6997b092bad4debd075be5e71976075f262e0e21f47e34db16ba1985d51d8017. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6997b092bad4debd075be5e71976075f262e0e21f47e34db16ba1985d51d8017
SHA3-384 hash: 00f74b0f7ff49dafa73a56c83ea93452d21aa024f69e5a1d055025b5d059a744cbd68285a4a645cb72b7d5d5c12f018f
SHA1 hash: 297b87289c0457f6b7aa6c5c808838dc6cb17617
MD5 hash: 14a78278a5fc63c3eadfdd153b37440a
humanhash: speaker-jersey-fanta-kansas
File name:14a78278a5fc63c3eadfdd153b37440a.exe
Download: download sample
File size:1'442'682 bytes
First seen:2021-08-30 16:45:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b78ecf47c0a3e24a6f4af114e2d1f5de (300 x GuLoader, 23 x Formbook, 21 x RemcosRAT)
ssdeep 24576:eqizO5t6Du+07g9Bg5L+oUc4USH9cwQ47ne86iyZdvc7EFONjU2L9ylkVoO:edzwtiBW+oUcWH9b7eD3cQFP2QlQoO
Threatray 737 similar samples on MalwareBazaar
TLSH T146653337B6E0CCA7D7A46231817D388306B0DA54C2A06F5A9399466DFAA72504EFF707
dhash icon 69ccd4d49696cc71 (13 x Adware.Adload, 8 x CoinMiner, 7 x ValleyRAT)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/183854/
Detection(s):
SecuriteInfo.com.BackDoor.Siggen2.2488.26461.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2096e683-d85d-42df-824b-54fe60f867a9
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/841754
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6997b092bad4debd075be5e71976075f262e0e21f47e34db16ba1985d51d8017/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-08-30 16:46:09 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1273c78b4f196fc982cb1e9b7abe9d2b5c4f10c5486e7a891615bb273fef419d
35e4927ea02978e01bee3917c5c2c92d46308473bf3eaf4ef1d4d3c0eb0a0d4f
3de11e9ba2b8db6be4069506a95bc31250d8ae8d0df5e8fec66121a05f1ccbc6
5f2846d5daa6e5781427feb62144502ff1522b8250eadbfb7aa3602d04eac1fb
65dee75f5d4f0d7e0c1065a689ebe79f67c87a4d3d9654193164128e859a0ddd
861f5a47b316a7668eedc2c5b7f7780406735223bd41a2a29f5df29331f7e51f
88c642b1fa43b77487f3916dd95ac236189971475c3289c745dc45a739e6453f
a5c940653c3b19cacd1378f2081feb377f2791257fbef36cd64df3a0b1b7d4b4
dcb25316bc3b1978f4acb2cce9804787843d832b46939195550ccdfc2f7f947c
f98183a2ad674f8aae6ad47e7da8b48c80175148ba333f0f57b3e6eca64bfaa6
+ 727 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210830-4vcb15kz52/
Behaviour
Enumerates physical storage devices
Unpacked files
SH256 hash:
6997b092bad4debd075be5e71976075f262e0e21f47e34db16ba1985d51d8017
MD5 hash:
14a78278a5fc63c3eadfdd153b37440a
SHA1 hash:
297b87289c0457f6b7aa6c5c808838dc6cb17617
Link:
https://www.unpac.me/results/45f088d4-04b5-4658-9bd3-29bb1a3b636d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.22
Link:
https://yomi.yoroi.company/submissions/6997b092bad4debd075be5e71976075f262e0e21f47e34db16ba1985d51d8017

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 6997b092bad4debd075be5e71976075f262e0e21f47e34db16ba1985d51d8017

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1540376/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/183854/

Comments