MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 799b7395c9f279d8cd1cd24657788ecb37db7ae03c0dddeb3344a95a551d1325. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 799b7395c9f279d8cd1cd24657788ecb37db7ae03c0dddeb3344a95a551d1325
SHA3-384 hash: 0548efd85144544ad9dfe8cfeb9ed2d8ff03e2e1998a01b3d1591c84f64518d88625f1bd172474d8df283c93d3804a84
SHA1 hash: 75c4ad5454f6293fbcd680984dbc9ea73bd1a64c
MD5 hash: 517882a348924dfa92e0dc6c5d1e525a
humanhash: north-dakota-kilo-wyoming
File name:799b7395c9f279d8cd1cd24657788ecb37db7ae03c0dddeb3344a95a551d1325
Download: download sample
File size:823'296 bytes
First seen:2020-08-02 07:33:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c73ceb1c88214748c7e7a62dbbde4788
ssdeep 12288:gp9CLf/dCCUSF/KDqEitSHTnXr4EGTt/LkDLELKi/t:yCLf/kC9F/KWEhH8MLELf/
Threatray 70 similar samples on MalwareBazaar
TLSH C3058E02B5C380F2D625193009E7A73ADB34D6461B14EFC79369DF699C332A19E372DA
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/37158/
Detection(s):
Win.Malware.Zusy-6840460-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file
Sending a UDP request
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
27 / 100
Link:
https://www.joesandbox.com/analysis/407108
Signature
a
c
d
e
f
g
h
i
L
M
n
o
p
r
s
t
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/799b7395c9f279d8cd1cd24657788ecb37db7ae03c0dddeb3344a95a551d1325/
Threat name:
Win32.Hacktool.ClipboardLogger
Create hunting rule
Status:
Malicious
First seen:
2019-01-18 01:18:40 UTC
File Type:
PE (Exe)
Extracted files:
40
AV detection:
28 of 48 (58.33%)
Threat level:
  1/5
Verdict:
malicious
Similar samples:
2e13c882d28c2236893a0a543e67c74a4f2e560d98c98b800f95c07938156a37
31153d0989d41bd597297136f2457681ac68bb89051509bba7d52c10c554a09e
56133c0d017af35f49253926e3583cf72c36146ab7faa65b6058971685166652
5edc0beea63d8b8533a31663df2bc2e860607c9befbd5fefc054afec6ce18ec9
683fa4be9635d3399ee7eb05dde053930faa95aae3f022cdc0e13e5980438b43
7333ddf4a7e53eeda33a8360b307471358597aeff78f4a5a7f4610640f97bdc7
7722f9fc1c3104b305915e49413e86df71e233fc2ac2914eee60ab7a59fcdf14
82385c5627675bb1a2f760238c766d1b8d3c31e109e067334959c084d62e5d55
8e3915f9ae220c0245e27de1ff632339aec8f12b80960f941c41e51ec1e25fa3
90924d67096320aa95b51034c85f09afd83dcecc5be6285b4d14d7973293eee7
+ 60 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200802-jfb4xgtpt2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_mbrlock_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/37158/

Comments