MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d2efda037fe23b1fe3a5bae44f5b9f7ddfdf621c5df6cb6999d801bbdf79b0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d2efda037fe23b1fe3a5bae44f5b9f7ddfdf621c5df6cb6999d801bbdf79b0f
SHA3-384 hash: 66c949fd32ef42cd10baa93ba93ddbc2e799bbb32bae1b68e694630b978fd8d949c80759b42ff8fa62af6428d3a54cc1
SHA1 hash: e8066a96876c287b837869412e6be99847f4588c
MD5 hash: bb23e3de5bcd95e4c5b47ba1276f4a39
humanhash: finch-solar-earth-failed
File name:6d2efda037fe23b1fe3a5bae44f5b9f7ddfdf621c5df6cb6999d801bbdf79b0f.bin
Download: download sample
File size:14'336 bytes
First seen:2021-12-28 22:12:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cd7553ae2854859eef9163f16af8a54b
ssdeep 192:jnijqcoo+ds8p90QRrEKYEP+mbSAuGrjH+QZga+IzCO/WoLucJIk75emydw6Rcc:bih4kQRoK8Q3rLgaxeOugu8PbyC6
Threatray 1'048 similar samples on MalwareBazaar
TLSH T158525D7FEA168C72F5F52A353235FE1B5DBE75300F24C6CBDE4004652864286AD78217
Reporter Arkbird_SOLG
Tags:exe LIKEAHORSE Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
238
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6d2efda037fe23b1fe3a5bae44f5b9f7ddfdf621c5df6cb6999d801bbdf79b0f.bin
Verdict:
Malicious activity
Analysis date:
2021-12-28 22:15:10 UTC
Tags:
ransomware
Link:
https://app.any.run/tasks/63750723-0ddd-411f-8447-2844cc4d90a1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/216703/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a service
Launching cmd.exe command interpreter
Creating a process with a hidden window
Creating a file in the %AppData% directory
Searching for synchronization primitives
Creating a file
Modifying an executable file
Changing a file
Moving a file to the Program Files directory
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Reading critical registry keys
Creating a file in the %temp% directory
Moving a file to the %temp% directory
DNS request
Deleting volume shadow copies
Creating a file in the mass storage device
Stealing user critical data
Encrypting user's files
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
filecoder greyware outsider ransomware upatre
Link:
https://www.filescan.io/uploads/61cb8befec6c6c14a9f9fd4a/reports/1d854bc5-dbfe-4845-8a99-0174998bfa3a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/90f49afb-f6d1-42a1-98b6-37d6b20b67de
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/913580
Signature
Antivirus / Scanner detection for submitted sample
Deletes shadow drive data (may be related to ransomware)
Malicious sample detected (through community Yara rule)
May disable shadow drive data (uses vssadmin)
Modifies the windows firewall
Moves / writes many txt or jpg files (may be a ransomware encrypting documents)
Multi AV Scanner detection for submitted file
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Tries to harvest and steal browser information (history, passwords, etc)
Uses bcdedit to modify the Windows boot settings
Writes many files with high entropy
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 546058 Sample: NL5IESB2do.bin Startdate: 28/12/2021 Architecture: WINDOWS Score: 100 39 Malicious sample detected (through community Yara rule) 2->39 41 Antivirus / Scanner detection for submitted sample 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 2 other signatures 2->45 7 NL5IESB2do.exe 502 2->7         started        11 notepad.exe 2->11         started        13 OpenWith.exe 2->13         started        process3 file4 31 C:\Users\...\MSIMGSIZ.DAT.LIKEAHORSE (copy), Unknown 7->31 dropped 33 C:\...\wcp-consent[1].js.LIKEAHORSE (copy), Unknown 7->33 dropped 35 thankyou-animation...n.LIKEAHORSE (copy), Unknown 7->35 dropped 37 175 other malicious files 7->37 dropped 47 May disable shadow drive data (uses vssadmin) 7->47 49 Moves / writes many txt or jpg files (may be a ransomware encrypting documents) 7->49 51 Deletes shadow drive data (may be related to ransomware) 7->51 53 4 other signatures 7->53 15 vssadmin.exe 1 7->15         started        17 cmd.exe 1 7->17         started        19 cmd.exe 1 7->19         started        21 cmd.exe 1 7->21         started        signatures5 process6 process7 23 conhost.exe 15->23         started        25 conhost.exe 17->25         started        27 conhost.exe 19->27         started        29 conhost.exe 21->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d2efda037fe23b1fe3a5bae44f5b9f7ddfdf621c5df6cb6999d801bbdf79b0f/
Threat name:
Win32.Trojan.OutSider
Create hunting rule
Status:
Malicious
First seen:
2021-12-28 06:40:21 UTC
File Type:
PE (Exe)
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
199f2dc4388a96b80edc0881ac6e70b33833ddb801d15a53981e0ce7624fe371
1f7971e9d98d51e7a89cb3cc698ef9f4e0be8a31790c509f75993c1e61c159d9
55560b608e7a7515329d395c72dc9cebc5cdd7b4c0f153d6e02eb74c2a609feb
5f5d1f324ed8dc18d76f200a176d40ab2ae48e336f33c2f7b5d047d682f3260a
6540d525cae788a13a66d8fb84b0760d43e39e3ec2de5199dd418b2deb703731
677f2c4c6849599ea1495487ffd91e6dfeb59972ae42c31d3266b57379deb086
8385eb7b18a881dcfdb87406a92c19b5b39676f5de60859a4a4034cf91e21c6d
b7573458498a18eb51b1195903a93f04e8f1e82bebf51fe92e3d42d291ba038b
+ 1'038 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
ransomware spyware stealer
Link:
https://tria.ge/reports/211228-143f2acgfm/
Behaviour
Delays execution with timeout.exe
Interacts with shadow copies
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops desktop.ini file(s)
Deletes itself
Drops startup file
Reads user/profile data of web browsers
Modifies extensions of user files
Deletes shadow copies
Unpacked files
SH256 hash:
6d2efda037fe23b1fe3a5bae44f5b9f7ddfdf621c5df6cb6999d801bbdf79b0f
MD5 hash:
bb23e3de5bcd95e4c5b47ba1276f4a39
SHA1 hash:
e8066a96876c287b837869412e6be99847f4588c
Link:
https://www.unpac.me/results/2cc8bba9-931a-4fdd-8584-fa238703133d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.48
Link:
https://yomi.yoroi.company/submissions/6d2efda037fe23b1fe3a5bae44f5b9f7ddfdf621c5df6cb6999d801bbdf79b0f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Destructive_Ransomware_Gen1
Create hunting rule
Author:Florian Roth
Description:Detects destructive malware
Reference:http://blog.talosintelligence.com/2018/02/olympic-destroyer.html
Rule name:Destructive_Ransomware_Gen1_RID31CB
Create hunting rule
Author:Florian Roth
Description:Detects destructive malware
Reference:http://blog.talosintelligence.com/2018/02/olympic-destroyer.html

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/fbgwls245/status/1475677726988447746
Cape
Cape
https://www.capesandbox.com/analysis/216703/

Comments