MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fc307063c376b8be2d3a9545959e068884d9cf7f819b176adf676fc4addef7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6fc307063c376b8be2d3a9545959e068884d9cf7f819b176adf676fc4addef7d
SHA3-384 hash: b461cdeac8693934dcc5a96567232fc0f1b5761fb89368761bae22181c4e15c5abb992ca6761a94ff0b4bff48b03260c
SHA1 hash: 2b45f14185d2116a994ee51a57dbc3d54ec45cf2
MD5 hash: aac324eac0e231d98a0b43fe19cb69d4
humanhash: fish-fillet-mexico-steak
File name:6fc307063c376b8be2d3a9545959e068884d9cf7f819b176adf676fc4addef7d
Download: download sample
File size:12'652'624 bytes
First seen:2021-07-12 07:04:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 196608:UP0FSdiBJVSnR89zkgW0qJmTp65ajjr1DnUs4kRU:40FwiUehk106ajjr1DnUYU
Threatray 711 similar samples on MalwareBazaar
TLSH T101D6231293B95ED2C59279F540635BD447AA2F5F2E3AC1EE4F8B3D98E830983493C2D1
Reporter JAMESWT_WT
Tags:BIOPASS exe signed

Code Signing Certificate

Organisation:Rhaon Entertainment Inc
Issuer:thawte SHA256 Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2019-01-02T00:00:00Z
Valid to:2021-03-02T23:59:59Z
Serial number: 06808c5934da036a1297a936d72e93d4
Intelligence: 35 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: b3ba6284885eadff7d2f7469c8c4aa2facc804ef21e54266fc543cc28e7c0cd4
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6fc307063c376b8be2d3a9545959e068884d9cf7f819b176adf676fc4addef7d
Verdict:
No threats detected
Analysis date:
2021-07-12 07:06:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/aa292077-afc9-4893-b3ce-cbedc3df9792

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/170919/
Detection(s):
SecuriteInfo.com.BackDoor.SiggenNET.5.27436.8753.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/491e0dbc-f5a9-401c-b53e-3d186860ee1c
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
51 / 100
Link:
https://www.joesandbox.com/analysis/814567
Signature
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Sigma detected: Execution from Suspicious Folder
Uses whoami command line tool to query computer and username
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 446978 Sample: 6yx1lxHN5L Startdate: 12/07/2021 Architecture: WINDOWS Score: 51 52 Multi AV Scanner detection for submitted file 2->52 54 PE file has a writeable .text section 2->54 56 Sigma detected: Execution from Suspicious Folder 2->56 9 6yx1lxHN5L.exe 502 2->9         started        process3 file4 38 C:\Users\Public\BPS\V2\init.exe, PE32 9->38 dropped 40 C:\Users\...\flashplayerpp_install_cn.exe, PE32 9->40 dropped 42 C:\Users\Public\BPS\V2\win32ts.pyd, PE32 9->42 dropped 44 470 other files (none is malicious) 9->44 dropped 12 init.exe 2 9->12         started        14 flashplayerpp_install_cn.exe 3 146 9->14         started        18 taskkill.exe 1 9->18         started        process5 dnsIp6 20 socketio.exe 5 12->20         started        22 cmd.exe 1 12->22         started        25 conhost.exe 12->25         started        46 36d6250d.tweb.sched.ovscdns.com 101.33.11.88, 443, 49732 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN China 14->46 48 36d6250f.tweb.sched.ovscdns.com 211.152.136.71, 443, 49734 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN China 14->48 50 5 other IPs or domains 14->50 62 Detected unpacking (changes PE section rights) 14->62 27 conhost.exe 18->27         started        signatures7 process8 signatures9 29 cmd.exe 20->29         started        32 conhost.exe 20->32         started        58 Uses whoami command line tool to query computer and username 22->58 34 conhost.exe 22->34         started        process10 signatures11 60 Uses whoami command line tool to query computer and username 29->60 36 whoami.exe 29->36         started        process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6fc307063c376b8be2d3a9545959e068884d9cf7f819b176adf676fc4addef7d/
Threat name:
Win32.Backdoor.BountyGlad
Create hunting rule
Status:
Malicious
First seen:
2020-11-25 02:27:52 UTC
File Type:
PE (Exe)
Extracted files:
2739
AV detection:
17 of 46 (36.96%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
3cc33ce58536242bc9b2029cd9475a287351a379ccbd12da6b8b7bf2cc68be89
458a03ecc28d7f704b5059263cfcad7cb94e51d5f5f2e0ad85e4e5b25da1e253
61640080e5604b1f88734d5d6d4dc118a79f3670053d5b297e0353dce9fa60bb
61d9f4cbc76b7889d7d17d262b63c0fd2ee40642653063b1eb6ab84397f8c57b
6d5307f8ae9c15be09190b6ff1f2c557d7a0519b765b6ef020ac3e7343fb190c
85043eafa7e9aadbb9ce3ad5450306dba8acd602408998e7becacfea4e236c93
9502b93f782ae19b93623605f74ebc2ee277a453ecd2286ef990d62c28a601e6
9bae8f0da8acb0e760eb61482cafc928199f841e10e0426a6650d140be0154c3
b655d3b9c40b930c8418be42858df38464ed574350bdef24dc99d1159e688e0b
de17e583a4d112ce513efd4b7cb575d272dcceef229f81360ebdfa5a1e083f11
+ 701 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210712-ykp6x5q9as/
Behaviour
Kills process with taskkill
Modifies Internet Explorer settings
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
467f6766c0fe82abc9286b530d7fa455360c8c7f20a7f28461c54873e4e4de21
MD5 hash:
6be622c4fd3a217b3f45dcd0b1897ffe
SHA1 hash:
0d31265517b835028a81eaf4e16dd3b60d4bc874
Link:
https://www.unpac.me/results/3ac6cf6f-77a3-49b3-ba2a-69348cf27430/
Parent samples :
e8d6393b63beba6b6cad43f7068f597f9a9c89effba80917412c3f438214ec5c
1eb83f805c41a946b3cf639512ddfe1da13fce7aca90270448f1b03c343befff
c513dde23b6e4d4274696e7598f01f0bc96953ad14556fb7de24c765ab574327
f52ed6bc805585d9e81b15a327af3ecbccc67aac180dff55968b5133035ce74d
b09326eda96f66176f54837d11d485a281dd89f24addc68f2c1e5cfedffe90e3
490c76da1ec8a15a782850b4468cc7ab780ce8cc436d7b490c280588864940cf
363e545ebbeb5eafa15f17986c7e90abebe28774b7b4bb2c1fcb2ff64c9158b8
021cdda10106e4db66873cd411ae3ea1d63ce01a0de1889f658d73c84ea00c8e
68ad2b97e4e2c2e2dedd7b7cbb3a0483c09948513f849bcd22ebeee1f8f40cd3
797c029eb74037b438d4c8eebc774dd45c243e86570d0a2118b168ea7472ca0d
a3ee42d49a63d91f51e144c2372002385da3573c8179ed743eef439904a6cdf4
55d421ed6221bf7cb9cfc4a78c3b7dd8407f19933fd26af3adb4f659bfe81abb
3803477a8eaad24fbd1fb71245a009f371eab35186065534bb14ae5dc41f8e4b
e88a142edb195e0d7e73616f3f5edc8a8ae6fd811c2985ac591c0925122ca8ee
66a517357eb8d9d77f8e4f1e67bcb3d3ad36b95010ae2a47caef8fe9018bcfe6
0916b368912885a4b72e1f309de846041bcbb3b74e478964f11797f0e4ace419
4c5b6f817e37e530c3440d02fcfd808aaef1e15f880fc9cdb43799ecc86bb1e9
d0d9d1a383cd3123e3a740793e4e9dab17701dd26856c3d13bdd84aa9b6f3c44
0504da7e2670ac33821b1d29ab8e430bd262a873fd07dfae680e7816c705cdd2
5783db0ba968957f967255d34b62546fdd3f6e70aa65b2b3fae44228bf6441ca
SH256 hash:
94bf4afd3a77d76311159daa2f19643a7f7d1e2c4b37807651b328feeef34668
MD5 hash:
1115be7832a7fa6005cb06aa20cdbb5c
SHA1 hash:
d0cf4dcc15749f031b4f5631bd603daf3bae1696
Link:
https://www.unpac.me/results/3ac6cf6f-77a3-49b3-ba2a-69348cf27430/
SH256 hash:
457dac9fbf63de9ae8de27ef01bb4cfbf631d8ee080232abff20f22c5afd0507
MD5 hash:
afc7051ea612b771a16aaf0e7521b783
SHA1 hash:
0ffd6781c6a02953d1ab4c3b5d53513a66ec4743
Link:
https://www.unpac.me/results/3ac6cf6f-77a3-49b3-ba2a-69348cf27430/
SH256 hash:
c1ea4d7c110167dde5e34def5e87939ff0a085a51da8d2e99ca7a7291002cd04
MD5 hash:
07e3aed600046253e236a90f8a824bde
SHA1 hash:
81939db413eb5f5494167366ce768a2aa6cce624
Link:
https://www.unpac.me/results/3ac6cf6f-77a3-49b3-ba2a-69348cf27430/
SH256 hash:
6fc307063c376b8be2d3a9545959e068884d9cf7f819b176adf676fc4addef7d
MD5 hash:
aac324eac0e231d98a0b43fe19cb69d4
SHA1 hash:
2b45f14185d2116a994ee51a57dbc3d54ec45cf2
Link:
https://www.unpac.me/results/3ac6cf6f-77a3-49b3-ba2a-69348cf27430/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/6fc307063c376b8be2d3a9545959e068884d9cf7f819b176adf676fc4addef7d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/170919/

Comments