MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75ad7745e2b81cb5ffc6d1e267b6c06f56f260452edf09ef4d6fd3ecad584e66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Plugx


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75ad7745e2b81cb5ffc6d1e267b6c06f56f260452edf09ef4d6fd3ecad584e66
SHA3-384 hash: 380693f0646e4fe81eb231221e1434f3e9de94822e4e6901804e488baf9f6ab266ffd4fb1909b34b161b972d2512c1e3
SHA1 hash: b6984512d630c45c759e84074c6a0670bc7824cb
MD5 hash: d4bbe83cc2d148175032e57a362d2f38
humanhash: bluebird-lactose-music-saturn
File name:75ad7745e2b81cb5ffc6d1e267b6c06f56f260452edf09ef4d6fd3ecad584e66
Download: download sample
Signature Plugx
Create hunting rule
File size:449'948 bytes
First seen:2021-08-02 09:21:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 027ea80e8125c6dda271246922d4c3b0 (10 x njrat, 7 x DCRat, 5 x DarkComet)
ssdeep 12288:nhxp3lZnT9bDuaI3yzO2dXPGSg9raq063Zd7:nJlh9bDuaIizhYwqB3Zd7
Threatray 736 similar samples on MalwareBazaar
TLSH T177A4E102BBD1C4B3D17359365979EB21A97CB9301F69CA5FA3D40D2EAA301806635FB3
dhash icon cdabae6fe6e7eaec (22 x Amadey, 9 x AurotunStealer, 8 x njrat)
Reporter JAMESWT_WT
Tags:exe Plugx

Intelligence

File Origin
# of uploads :
1
# of downloads :
415
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
75ad7745e2b81cb5ffc6d1e267b6c06f56f260452edf09ef4d6fd3ecad584e66
Verdict:
Malicious activity
Analysis date:
2021-04-12 13:53:19 UTC
Tags:
trojan plugx
Link:
https://app.any.run/tasks/a57fba11-ad2b-4a6c-ad79-f15f474e0fdb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/175758/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Sending a UDP request
Malware family:
Thor
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9477aa48-b1ef-4f7a-8d02-aca3bf1d842d
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/673104
Signature
Found evasive API chain (may stop execution after checking mutex)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 385502 Sample: 4BQ9K2n4LA Startdate: 12/04/2021 Architecture: WINDOWS Score: 64 62 Multi AV Scanner detection for dropped file 2->62 64 Multi AV Scanner detection for submitted file 2->64 9 4BQ9K2n4LA.exe 26 2->9         started        12 Smadav.exe 2->12         started        14 Smadav.exe 2->14         started        process3 file4 54 C:\Users\user\Desktop\SmadHook32c.dll, PE32 9->54 dropped 56 C:\Users\user\Desktop\Smadav.exe, PE32 9->56 dropped 16 Smadav.exe 3 6 9->16         started        process5 file6 50 C:\ProgramData\Smadav\SmadavIUe\Smadav.exe, PE32 16->50 dropped 52 C:\ProgramData\Smadav\...\SmadHook32c.dll, PE32 16->52 dropped 19 Smadav.exe 7 16->19         started        process7 dnsIp8 58 43.254.217.165, 110, 49712, 49716 CLOUDIE-AS-APCloudieLimitedHK Hong Kong 19->58 60 192.168.2.1 unknown unknown 19->60 66 Found evasive API chain (may stop execution after checking mutex) 19->66 23 cmd.exe 1 19->23         started        26 cmd.exe 19->26         started        28 cmd.exe 19->28         started        30 8 other processes 19->30 signatures9 process10 signatures11 68 Uses schtasks.exe or at.exe to add and modify task schedules 23->68 32 conhost.exe 23->32         started        34 conhost.exe 26->34         started        36 schtasks.exe 26->36         started        38 conhost.exe 28->38         started        40 schtasks.exe 28->40         started        42 conhost.exe 30->42         started        44 schtasks.exe 30->44         started        46 conhost.exe 30->46         started        48 11 other processes 30->48 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/75ad7745e2b81cb5ffc6d1e267b6c06f56f260452edf09ef4d6fd3ecad584e66/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-11-16 04:26:23 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
33 of 46 (71.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=owwxorpcxaoll76g2hrgpnwan5lpeycff3pqt32nn7j6zlkyjzta._file
Verdict:
malicious
Similar samples:
0d852bfcbc49afecc18e426f7d694597966256d55c225a4ae798a7e98200b5ca
Plugx
267c37f15594e1b55c509e743784ba4e05a7f2d5aa554a55a9357d1fc45b74f4
Plugx
2da4deb25af7d67826547e77ca4bcac202eb492d2cb5238b8c9fecaac3ac05a9
Plugx
4f79aa8d648c5a999fb91196040b6b68db284ba1b892217563df71db9ae477f3
Plugx
8774f12d56159a7cbf0e8e2a3618721ea9ca23a7641fe7da417ac0380b5f8d7f
Plugx
8ea2458e1ff6924354036dedcbf1ee6ae2a406c97f984651b1d6ba9309c3a1e7
Plugx
b369da8fa3af7d482c5c81e437c58388e4ab9dfe363adb16197b8c8133fb406e
Plugx
bf29918a0b7d197baf8bfe6c2338ca4f5428280ba5375cb48fd02b92acc55f38
Plugx
f221abcc28479d141353cdf6963987ed217d33eea32cca67e10a68e63c1dfc7a
Plugx
ffe8dbb5865f5493872432f968c9a6183fdf7b79f62b17b5093af5028497cb33
Plugx
+ 726 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210802-rtyecs6kna/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
4328838a578c3372b61ba77e838f1c5f9e7a54b3451928b4ada9c26e5de2133e
MD5 hash:
65bad9275c3cc687e6b4f4e330b6cbed
SHA1 hash:
1e6f88407d155c555042bd6ba6d83e99ef275a86
Detections:
win_plugx_auto
Create hunting rule
Link:
https://www.unpac.me/results/70dbf86a-2689-45bd-af00-60c2775a4ac0/
SH256 hash:
2efeb917a50275c035d18f08878620ecc9c0eb4c1ce3cc7da377e18b30a0e790
MD5 hash:
7848879ff330146e3249033b9c8a671d
SHA1 hash:
441dba0fb2e7ce9af51a1697bc233b37f3ff64cc
Link:
https://www.unpac.me/results/70dbf86a-2689-45bd-af00-60c2775a4ac0/
SH256 hash:
75ad7745e2b81cb5ffc6d1e267b6c06f56f260452edf09ef4d6fd3ecad584e66
MD5 hash:
d4bbe83cc2d148175032e57a362d2f38
SHA1 hash:
b6984512d630c45c759e84074c6a0670bc7824cb
Link:
https://www.unpac.me/results/70dbf86a-2689-45bd-af00-60c2775a4ac0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/75ad7745e2b81cb5ffc6d1e267b6c06f56f260452edf09ef4d6fd3ecad584e66

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/175758/

Comments