MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ff9db55858b84c4eed7dd8ae5221e8e56b72e98b9006c7bda7c38f7874d4f5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ff9db55858b84c4eed7dd8ae5221e8e56b72e98b9006c7bda7c38f7874d4f5b
SHA3-384 hash: d2c4a1291bfe7703a6cce9d1c4ea4feb8da43479b3774454666050e25b9859b480e5ee74b119e228ea62b89a43a308b2
SHA1 hash: 2379b04c93e74a9b40a8c5626c78d865ffa968eb
MD5 hash: 1676a99f443d3dd4c95d9b9aa3a82001
humanhash: green-echo-wolfram-quiet
File name:SecuriteInfo.com.FileRepMalware.21685.30532
Download: download sample
File size:1'634'927 bytes
First seen:2023-10-10 10:41:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3168c6aebe417b9e3f8149594c4d0c73
ssdeep 24576:3DA1WIdbFvz8No4enfjBlfIROPXwDoo+qxBRjUUpK6om15rWr7jEyGHNPfVLwkYu:0AKFaoxjzIAPXwr+1YKncQKP9E9KF08
Threatray 33 similar samples on MalwareBazaar
TLSH T170753322C16B6D8CDE483173E02B6D9A17F6C8A3C1622F2BD017C55AB31C99798BD44F
TrID 29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4505/5/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon d5d4f89484d4f133
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
273
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/452876/
Detection(s):
PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

PUA.Win.Packer.Anti-29
Create hunting rule

PUA.Win.Packer.Anti-28
Create hunting rule

PUA.Win.Packer.Nspack-26
Create hunting rule

PUA.Win.Packer.NPack-3
Create hunting rule

PUA.Win.Packer.Nspack-1
Create hunting rule

PUA.Win.Packer.Nspack-25
Create hunting rule

PUA.Win.Packer.Nspack-22
Create hunting rule

SecuriteInfo.com.FileRepMalware.21685.30532.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file
Enabling the 'hidden' option for recently created files
Searching for synchronization primitives
DNS request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin nspack packed packed packed shell32
Link:
https://www.filescan.io/uploads/65252a9264965c51f779f0ac/reports/fce4d1ed-eaf9-43cf-a429-1923a35d85f8/overview
Verdict:
Malicious
Labled as:
Trojan.Jorik
Link:
https://www.hybrid-analysis.com/sample/6ff9db55858b84c4eed7dd8ae5221e8e56b72e98b9006c7bda7c38f7874d4f5b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CoinMiner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3c706a38-5552-4026-9159-d065a81b2b30
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1322753
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ff9db55858b84c4eed7dd8ae5221e8e56b72e98b9006c7bda7c38f7874d4f5b/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2013-03-25 13:36:00 UTC
File Type:
PE (Exe)
Extracted files:
56
AV detection:
18 of 37 (48.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n745wvmfrocmj3wx3wfokiq6rzlloluyxeagy662pq4ppb2nj5nq._file
Verdict:
unknown
Similar samples:
18c6cb8dbdcb66ab3c7f48de9e8c2317bd16ea6f7953eada4694efbba00ac9ce
45982d6a7674a3ff4d2f28e95963d74729e0cb3059c08ef2e4c235182bf4591d
4692e6564182d77b41960d15e3b8beb89f0d2c0efe7c035e70e349414233a3fb
703719daf8e118d5ef1f57c1bccdece5ab8a762a094bb26bde7d2c9d50530724
83e11774e75ac33d5e754c051e42a87c516a646d78d06375d8c345761fca7e77
95162c88c4514933e17cb2e8c95ca272b80d38c87992aa5af712901a2af965cf
aa3792858633f1c2e3400c961497b98d28e8a82c179ef7c04fabd070fc971859
bfe85700c95ee65a50c47769f003c792d9b7cc407359a6d6df795c3bbb3fef8b
c5d24b4a21b5ce63ea8752778e37059f9fd0f4d738b760f6c03b2b902f67f848
+ 23 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
upx
Link:
https://tria.ge/reports/231010-mrpshscg8w/
Behaviour
Suspicious use of SetWindowsHookEx
ACProtect 1.3x - 1.4x DLL software
Loads dropped DLL
UPX packed file
Unpacked files
SH256 hash:
6ff9db55858b84c4eed7dd8ae5221e8e56b72e98b9006c7bda7c38f7874d4f5b
MD5 hash:
1676a99f443d3dd4c95d9b9aa3a82001
SHA1 hash:
2379b04c93e74a9b40a8c5626c78d865ffa968eb
Link:
https://www.unpac.me/results/60b43e0d-1b51-4175-baa6-2f8571760306/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.76
Link:
https://yomi.yoroi.company/submissions/6ff9db55858b84c4eed7dd8ae5221e8e56b72e98b9006c7bda7c38f7874d4f5b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:NsPacKV37LiuXingPing
Create hunting rule
Author:malware-lu
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/452876/

Comments