MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e176a6a67a3db2b56398f4d940c956270a1d145a3b126fa37cc164530a6f5ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Reconyc


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e176a6a67a3db2b56398f4d940c956270a1d145a3b126fa37cc164530a6f5ab
SHA3-384 hash: 59e850a4a0e288ce43b9d64572919253bf2143bcc481186145487f642cdaa93b93e42abeb1628415eb0a91794ad89389
SHA1 hash: 20c8823bf220a5ce0d63c73e6a42dc0d35db8d91
MD5 hash: 7d984e51350cb2624b7cfdcc8c56d936
humanhash: fourteen-seven-minnesota-hydrogen
File name:a05436618a232e2c14327566af6a4649
Download: download sample
Signature Reconyc
Create hunting rule
File size:688'129 bytes
First seen:2020-11-17 12:00:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ef3fd1c1a81435e51fcc42212e25d2ec (7 x Reconyc)
ssdeep 12288:1lJ08kD7/mW9fRb4VVdGnajC8XMWSmeB8ONAwInHfzPBnwYyaoprgm0aau8TItO:1D08kDBJ6Gau8cWSzBNvIHbBnwYytpry
Threatray 60 similar samples on MalwareBazaar
TLSH 48E401E570D9C5C7ED3B1BB7DA51A08C1C56A224929AECB0BA82AD06E473DDC4344F4F
Reporter seifreed
Tags:Reconyc

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Xcnfe-6978972-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Replacing executable files
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Creating a window
Launching a process
Searching for the window
Forced system process termination
Changing a file
Moving of the original file
Setting a single autorun event
Blocking a possibility to launch for the Windows Task Manager (taskmgr)
Forced shutdown of a system process
Deleting of the original file
Forced shutdown of a browser
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e176a6a67a3db2b56398f4d940c956270a1d145a3b126fa37cc164530a6f5ab/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-11-17 12:05:12 UTC
AV detection:
41 of 48 (85.42%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nylwu2thupnswvrzr5gzidevmjykdukfuoysn6rxzqlekmfg6wvq._file
Verdict:
malicious
Similar samples:
06e145e0068c9631d558c1f1c04b51fe8c6a36052a6a051986642eb0dec85232
Reconyc
473312ffebfedba134fb127faaccf6c0084c03d268f3f333e0722bff8cbaab3d
Reconyc
6153eb4861731cb8b710414247b40ca5851a31c6a79b44d488d02d59b4abc5ff
Reconyc
75da456980b6c16a80a05269d6fee93bc18a242ebe0c7f9f014bad8828b09291
Reconyc
8c41074da2e38da01c61a00a6fb9a9983d5e6091547b4f7a5f74b3797a5a59fe
Reconyc
8d5fcc37dd8243986f9bb28dccd74960163c965f87f23fc4e0360f17188cc332
Reconyc
9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f
Reconyc
ae00e3b5b5b3fe0b6ecf5c4ccbd461eee232654c45134a66d8e4a3b7cdcdf55a
Reconyc
bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2
Reconyc
ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398
Reconyc
+ 50 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/201117-xk53bm9y9s/
Behaviour
Checks SCSI registry key(s)
Enumerates system info in registry
Modifies Control Panel
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
System policy modification
Program crash
Modifies service
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Enumerates connected drives
Deletes itself
Loads dropped DLL
Executes dropped EXE
Modifies Installed Components in the registry
Unpacked files
SH256 hash:
6e176a6a67a3db2b56398f4d940c956270a1d145a3b126fa37cc164530a6f5ab
MD5 hash:
7d984e51350cb2624b7cfdcc8c56d936
SHA1 hash:
20c8823bf220a5ce0d63c73e6a42dc0d35db8d91
Link:
https://www.unpac.me/results/dfd518b0-72f8-4904-88e6-2ae97dbc3988/
SH256 hash:
337b42e2455713becb3d1666fe521dfdba79f6a190c33c86a2ba31a8a98d38dd
MD5 hash:
a02d8cf6e69971bbade7a3411ca326fd
SHA1 hash:
378d61fd0fad637d1a7a99c35329f3d6a1b6170f
Link:
https://www.unpac.me/results/dfd518b0-72f8-4904-88e6-2ae97dbc3988/
SH256 hash:
86cbc62a46118ca297c613b9315467d4966c761b152cb6867ff454850626718d
MD5 hash:
ecb89d0d5fd5b33f2592c98d15630d1f
SHA1 hash:
dec270d24317258177c60eb472d469167e59fdc7
Link:
https://www.unpac.me/results/dfd518b0-72f8-4904-88e6-2ae97dbc3988/
SH256 hash:
cee145a0d54dc0f206c91129d14f98fa531e9c2829c4e724286869794bc7e716
MD5 hash:
deda2cb64a760ca5f8c1a2c33e15886b
SHA1 hash:
eb69820d5f29db608cef0d7dd80d9943f436ab37
Link:
https://www.unpac.me/results/dfd518b0-72f8-4904-88e6-2ae97dbc3988/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments