🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
SHA3-384 hash: e4298fe9af4f94e7d98d7fc1731f39ff1b424bdc69091b6ccf5d6056cf1632e7f8927368339351dbcd452feb62983fd6
SHA1 hash: b3892eef846c044a2b0785d54a432b3e93a968c8
MD5 hash: 461ade40b800ae80a40985594e1ac236
humanhash: glucose-dakota-west-mockingbird
File name:rdpwrap.bin
Download: download sample
File size:116'736 bytes
First seen:2021-08-10 05:37:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 53a3dacee6717ddc12074523c645029b
ssdeep 3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
Threatray 91 similar samples on MalwareBazaar
TLSH T14EB35B4773A100BBD4A7D638CDA34A12D77A78864771AB4E1790459A9F337E09E3CB31
Reporter JAMESWT_WT
Tags:exe RDPWrap

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
wechat-84839.exe
Verdict:
Malicious activity
Analysis date:
2021-08-09 17:26:43 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/be5f965b-3db2-4c5e-abe8-d38019334919

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/177801/
Detection(s):
SecuriteInfo.com.Program.Rdpwrap.7.30194.2033.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Malware family:
RDPWrap
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/b87d6c1b-01ef-4ca3-a827-458224806615
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/807937
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 440348 Sample: QTEBRm6RG8.dll Startdate: 25/06/2021 Architecture: WINDOWS Score: 48 19 Multi AV Scanner detection for submitted file 2->19 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        13 rundll32.exe 2 7->13         started        15 2 other processes 7->15 process5 17 rundll32.exe 9->17         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4/
Threat name:
Win64.PUA.Presenoker
Create hunting rule
Status:
Malicious
First seen:
2015-04-12 03:54:56 UTC
File Type:
PE+ (Dll)
AV detection:
18 of 47 (38.30%)
Threat level:
  1/5
Verdict:
unknown
Similar samples:
100d72df90d93cea79a74e9550eaee5ce52d393d0281cdb3adfe17046e2ef4ac
411a64366a6b5b9e57bd06dcdccd377ea02d9ed7e8be0f290f0674e3d7ff3215
611086722efb829d07f7059226cd4a0ab3544945c63c622eb11133027517654e
7b7b7e7ad9b106a5508583f1b60e3a3d7385bf0d6592ca816839f6633f5e8045
94fd8c7b7935c64a7ed46794b3b5597800ae02715d5d0d95df19b208dc0d98fb
a0792945510f126714a42e9b4cef8b7e8d7aab504772b076c6df0a4e96f08e89
ad7968f514af1229d279999f3b31876a6e78edcf4eb1584a27bf51e6d3f4c338
be66827292b98575cb69b0898954699f52c491ddb0bc8c613a70d20fb3871657
e3f01ed8d12f734d433783b0fe727e25e1a9a982a38e50fe72734c75c146df07
e81c6b84f83b9ac8233102f31e21bfeeab4ffaa5aa4c02987ce910de908a83ed
+ 81 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210810-aav4lszgls/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Unpacked files
SH256 hash:
798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
MD5 hash:
461ade40b800ae80a40985594e1ac236
SHA1 hash:
b3892eef846c044a2b0785d54a432b3e93a968c8
Link:
https://www.unpac.me/results/d93b8489-16e1-43e0-85d1-8b167a797fec/
Parent samples :
ac91b2a2db1909a2c166e243391846ad8d9ede2c6fcfd33b60acf599e48f9afc
4aa18745a5fddf7ec14adaff3ad1b4df1b910f4b6710bf55eb27fb3942bb67de
663bb8fd085cf61f0204f2f5a9cbed5c5d1eb08aebbb6dbb47702c328b44c3e2
fc16a364530103595b8d36d6c3e7f00a08bf5783c6860bf63bcdbeb90b6c78f8
f08f77c93c18f55c22c54418b22c4e658d1272f838572a2063796545be6d2015
5c48f798b6580ed54a0d46bffe344ae35e1de3db5530d9e6072a92eee47fafc6
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_Lazarus_Loader_Dec_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect loader used by Lazarus group in december 2020
Reference:Internal Research
Rule name:RDPWrap
Create hunting rule
Author:@bartblaze
Description:Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:https://github.com/stascorp/rdpwrap

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/177801/

Comments