🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 704cb0cc7b48b707741da5142d115deefc9409e4a66967df2aa5cc77f0705892. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mekotio


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 704cb0cc7b48b707741da5142d115deefc9409e4a66967df2aa5cc77f0705892
SHA3-384 hash: 6779fd99f902151724fa5429e4fccb4f3e30d914123ab40fb4441494931b2e2b709a77a3aba0668e7cd2063acf2c7abb
SHA1 hash: 7f6a953209928d8012d6c2fd77d18ff4bf4a2abd
MD5 hash: 984c43db9b52c92366867abf6337fd31
humanhash: seventeen-grey-west-low
File name:VYxSGOsyiv.dll
Download: download sample
Signature Mekotio
Create hunting rule
File size:16'651'264 bytes
First seen:2021-04-29 15:00:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ff750281199fd75b463a9612c10a02fe (2 x Mekotio)
ssdeep 196608:Rg5cQdiZTyKVvLYP+1oNAHisCHdt5PvLtff/V8HepN/YwQn:RkdiZLVcPZ5tRPvpFtpBE
Threatray 9 similar samples on MalwareBazaar
TLSH C1F6BE3F72A4922CC15EC57AC0938F40A633B1799B76C6FB629507941F179C86E3FA24
Reporter JAMESWT_WT
Tags:dll Mekotio Servizio fiscale spy


Avatar
JAMESWT_WT
Servizio fiscale

Intelligence

File Origin
# of uploads :
1
# of downloads :
173
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://notficamasternetsjfh102948.switzerlandnorth.cloudapp.azure.com/Notif/Notifiche.zip
Verdict:
Malicious activity
Analysis date:
2021-04-29 14:54:54 UTC
Tags:
opendir
Link:
https://app.any.run/tasks/6bb44966-e70e-40ff-8176-b1fef52bdd25

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Mekotio.23.10999.31050.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/702647
Signature
Creates an autostart registry key pointing to binary in C:\Windows
Hides threads from debuggers
Multi AV Scanner detection for submitted file
Obfuscated command line found
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
System process connects to network (likely due to code injection or exploit)
Tries to detect debuggers (CloseHandle check)
Tries to detect debuggers by setting the trap flag for special instructions
Tries to detect virtualization through RDTSC time measurements
Very long command line found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 400247 Sample: VYxSGOsyiv.dll Startdate: 29/04/2021 Architecture: WINDOWS Score: 96 63 Multi AV Scanner detection for submitted file 2->63 65 PE file contains section with special chars 2->65 8 loaddll64.exe 1 2->8         started        11 rundll32.exe 2->11         started        13 rundll32.exe 2->13         started        process3 signatures4 67 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->67 69 Obfuscated command line found 8->69 71 Very long command line found 8->71 73 4 other signatures 8->73 15 rundll32.exe 4 1 8->15         started        19 rundll32.exe 8->19         started        21 rundll32.exe 8->21         started        23 7 other processes 8->23 process5 dnsIp6 39 onedrive.live.com 15->39 41 dm-files.fe.1drv.com 15->41 43 az12lg.dm.files.1drv.com 15->43 51 System process connects to network (likely due to code injection or exploit) 15->51 53 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 15->53 55 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->55 61 3 other signatures 15->61 45 onedrive.live.com 19->45 47 dm-files.fe.1drv.com 19->47 49 az12lg.dm.files.1drv.com 19->49 57 Tries to detect debuggers (CloseHandle check) 19->57 59 Hides threads from debuggers 19->59 25 WerFault.exe 9 21->25         started        28 rundll32.exe 23->28         started        31 WerFault.exe 9 23->31         started        33 WerFault.exe 23->33         started        signatures7 process8 dnsIp9 37 192.168.2.1 unknown unknown 25->37 75 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 28->75 77 Tries to detect debuggers (CloseHandle check) 28->77 79 Hides threads from debuggers 28->79 35 WerFault.exe 20 9 28->35         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/704cb0cc7b48b707741da5142d115deefc9409e4a66967df2aa5cc77f0705892/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-04-29 12:18:57 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
071726ffe3567442cc251bb3bf1b72db413081cbe1a41483c8cc230c31834816
Mekotio
55f45920bfb21ab53d0c8fb4aededc3ee798170197fa2fd9b88dfcfeccdcac41
Mekotio
569be6a3e9eeede01d5b2bab288aba6de5d5759684ed526986b8d01923c591af
Mekotio
686e60d6079a08eaafcdca5ab248cbc18cae7c6871b989c3bcbcb9a02fd5fad9
Mekotio
6bd76be4ebf2b1fa8a1580609fb475a10b669baa3d1744eaa58f3ec2df393dad
Mekotio
92956d8d80a5032afc293e59db2523f649227980524b55cfaf0402545bc57050
Mekotio
be1bf1d06cc023ead20f1878f3a62a8c97342d0aa7102fe583ea39a932162027
Mekotio
bfd12725c557e1a9992dccff4257290adec43be6315f68471af0d26c9fa662ad
Mekotio
f923c5ce0a44f73f86dbb04d02905e0e0068d675f6095680b41d904380800e17
Mekotio
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/210429-gxnd4m993s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Unpacked files
SH256 hash:
704cb0cc7b48b707741da5142d115deefc9409e4a66967df2aa5cc77f0705892
MD5 hash:
984c43db9b52c92366867abf6337fd31
SHA1 hash:
7f6a953209928d8012d6c2fd77d18ff4bf4a2abd
Link:
https://www.unpac.me/results/affb9a47-39cb-45c0-a244-2c86e09ca1a9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/704cb0cc7b48b707741da5142d115deefc9409e4a66967df2aa5cc77f0705892

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments