MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7949bf3e09366bdb23ca7472cb6c4d9183ad5b081ac5a568d556aec8beae0785. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Phobos
Vendor detections: 4
| SHA256 hash: | 7949bf3e09366bdb23ca7472cb6c4d9183ad5b081ac5a568d556aec8beae0785 |
|---|---|
| SHA3-384 hash: | 14aea42b9393ac3fa01ae021dba4c2a2e7242c265081f17ad15085154b75373faca7a7b033987272f5e811a1bd539e39 |
| SHA1 hash: | 938df1b239015ffb444c0f958b15ee6b5ce0b40d |
| MD5 hash: | 636a3d5759907f7a3261beac3f75ca6a |
| humanhash: | emma-mountain-kansas-lemon |
| File name: | c597eb1cfd24dfca1b17b7fd61c4527c.exe |
| Download: | download sample |
| Signature | Phobos |
| File size: | 58'368 bytes |
| First seen: | 2020-04-05 15:07:06 UTC |
| Last seen: | 2020-04-08 15:00:22 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 03cae632c46883e0fd8e744440cd27c0 (5 x Phobos) |
| ssdeep | 1536:2kcgYgbig9EhjWNMSTdwp++lJ/KAJnm5F1tEhSalMz:2j8ijWNw++lgAJnu3aM2u |
| Threatray | 8 similar samples on MalwareBazaar |
| TLSH | 6843C046346D94B2CD338570293D2F4B8FBA621554A84497CF294ECA3ED1116EB3E3BB |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader Phobos |
abuse_ch
Payload dropped by GuLoader from the following URL:https://drive.google.com/uc?export=download&id=1c3fbF-r9OjtBh5GaGVeb9_C2afNvlAdY
Intelligence
File Origin
# of uploads :
3
# of downloads :
1'871
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Phobos
Status:
Malicious
First seen:
2020-03-20 08:37:41 UTC
File Type:
PE (Exe)
AV detection:
29 of 31 (93.55%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
287eba5554654ce40f9db1e5fda08345ca3e3848341e9536b5bcd949c37d4133
Dropped by
MD5 c597eb1cfd24dfca1b17b7fd61c4527c
Dropped by
MD5 3e585362a15cbca715a66f21bc29aa65
Dropped by
GuLoader
Dropped by
SHA256 287eba5554654ce40f9db1e5fda08345ca3e3848341e9536b5bcd949c37d4133
Dropped by
SHA256 d06db02b857f242fc1f0cf0d1847686b4ddd47ab2e2e9b844a3fcf2e7c587b5c
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| AUTH_API | Manipulates User Authorization | ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::EqualSid ADVAPI32.dll::FreeSid |
| SECURITY_BASE_API | Uses Security Base API | ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::DuplicateTokenEx ADVAPI32.dll::GetTokenInformation |
| SHELL_API | Manipulates System Shell | SHELL32.dll::ShellExecuteExW |
| WIN32_PROCESS_API | Can Create Process and Threads | KERNEL32.dll::CreateProcessW KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenProcessToken WINHTTP.dll::WinHttpCloseHandle KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread |
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::TerminateProcess KERNEL32.dll::GetVolumeInformationW |
| WIN_BASE_EXEC_API | Can Execute other programs | KERNEL32.dll::AllocConsole KERNEL32.dll::WriteConsoleW |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::CopyFileW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::GetFileAttributesW KERNEL32.dll::FindFirstFileW |
| WIN_BASE_USER_API | Retrieves Account Information | KERNEL32.dll::GetComputerNameW ADVAPI32.dll::LookupAccountSidW ADVAPI32.dll::LookupPrivilegeValueW |
| WIN_HTTP_API | Uses HTTP services | WINHTTP.dll::WinHttpConnect WINHTTP.dll::WinHttpOpenRequest WINHTTP.dll::WinHttpOpen WINHTTP.dll::WinHttpReceiveResponse WINHTTP.dll::WinHttpSendRequest |
| WIN_NETWORK_API | Supports Windows Networking | MPR.dll::WNetEnumResourceW MPR.dll::WNetOpenEnumW MPR.dll::WNetUseConnectionW |
| WIN_REG_API | Can Manipulate Windows Registry | ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW |
| WIN_SOCK_API | Uses Network to send and receive data | WS2_32.dll::WSAAddressToStringW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.