MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79d53f943bc31422487463c4990423e0aeb8960c61e8608b25222c07a4066319. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79d53f943bc31422487463c4990423e0aeb8960c61e8608b25222c07a4066319
SHA3-384 hash: 1aca91e06c123c924b5d70618367b0c9d43ba1da8d5c413d3b2616106c40cdce1c012135e27c2de2876db8d0848d1bfe
SHA1 hash: 81e89dbf1bdfb00ed2199d97306630d24ccca59d
MD5 hash: 52e413fdda17fc466e537daa876264f6
humanhash: sixteen-sierra-video-white
File name:SecuriteInfo.com.Trojan.DownLoader44.16575.18.17559
Download: download sample
File size:3'277'312 bytes
First seen:2021-12-17 10:58:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 61c3df730291850fea0c9a7171786100 (13 x CoinMiner)
ssdeep 49152:6ypju7KGOO8Wk7XububTaERZMZo9nQUg8/nrEh880i1IDQh2:6cSKGNk7kIaERZ1nQa/nex0iec
Threatray 63 similar samples on MalwareBazaar
TLSH T126E523D7F99F8DFDC1020A31E861A4149F0A64330FF78960075DAB1F74D666693CBA8A
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://mega.nz/file/VqhnxYzI#Zm_CefWJwSODTCz42u-MfEKgJnIHDVAUXg4izoMIl90
Verdict:
Malicious activity
Analysis date:
2021-12-15 23:58:40 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/75264f95-5eff-4924-bb36-806708a4307f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/214790/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader44.16575.18.17559.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Running batch commands
Launching a process
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Creating a window
Searching for the window
Blocking the Windows Defender launch
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Malware family:
n/a
Score:
  0/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/2378/overview
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
enigma packed
Link:
https://www.filescan.io/uploads/61bc6d7a8541392eb4ec12f9/reports/6d546bce-eb7d-43d8-9571-bdc6d5f42201/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f73ff351-06de-4c48-bd4c-0b4d992bd601
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
66 / 100
Link:
https://www.joesandbox.com/analysis/909041
Signature
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (overwrites its own PE header)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Uses the Telegram API (likely for C&C communication)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 541519 Sample: SecuriteInfo.com.Trojan.Dow... Startdate: 17/12/2021 Architecture: WINDOWS Score: 66 37 Multi AV Scanner detection for dropped file 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 Machine Learning detection for sample 2->41 43 3 other signatures 2->43 7 SecuriteInfo.com.Trojan.DownLoader44.16575.18.exe 1 22 2->7         started        process3 dnsIp4 33 github.com 140.82.121.3, 443, 49759, 49760 GITHUBUS United States 7->33 35 192.168.2.1 unknown unknown 7->35 29 C:\Users\user\AppData\Roaming\...\RegHost.exe, PE32+ 7->29 dropped 45 Detected unpacking (overwrites its own PE header) 7->45 47 Creates HTML files with .exe extension (expired dropper behavior) 7->47 49 Hides threads from debuggers 7->49 12 cmd.exe 1 7->12         started        14 cmd.exe 1 7->14         started        16 cmd.exe 1 7->16         started        18 2 other processes 7->18 file5 signatures6 process7 process8 20 curl.exe 1 12->20         started        23 conhost.exe 12->23         started        25 conhost.exe 14->25         started        27 conhost.exe 16->27         started        dnsIp9 31 api.telegram.org 149.154.167.220, 443, 49758 TELEGRAMRU United Kingdom 20->31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79d53f943bc31422487463c4990423e0aeb8960c61e8608b25222c07a4066319/
Threat name:
Win64.Trojan.Vimditator
Create hunting rule
Status:
Malicious
First seen:
2021-12-12 16:14:02 UTC
File Type:
PE+ (Exe)
AV detection:
29 of 45 (64.44%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
17cf75eb6b87af72f6fbddbe3ce9653f74ef56718198160c454086bb87866676
3426d12d872333a290c333ef0cff53ccd94966fe5826106ebc3d819cf078698b
565b1484478b1644bd1e8954e079f653b8f71c9f16997d4b7fc53f83da609e35
6467af2474360133a3d9fd753097c250d5673f5a6a8b58fd5ac773486cd1ae7c
735b327fa288036469c2b9bfd97ad7b75900f7a8980dae26e40188dbeb425993
c14c17020a470e53754dc2654847e9fbc6fa6f0326e515d10c6a581ad2c8825f
c937ab727bd34bd8c83e2ea01054cd60363ca35bd99fccf46b1f1f1f119715db
ed3b91ec20184139f90c2432c7d90567dc9c47afc45a87bb4d72fa4a6c64edd9
+ 53 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan
Link:
https://tria.ge/reports/211217-m3d56aecdk/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Modifies Windows Defender Real-time Protection settings
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
79d53f943bc31422487463c4990423e0aeb8960c61e8608b25222c07a4066319
MD5 hash:
52e413fdda17fc466e537daa876264f6
SHA1 hash:
81e89dbf1bdfb00ed2199d97306630d24ccca59d
Link:
https://www.unpac.me/results/b9c731e4-7eca-4df6-a63b-6831b3572464/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.03
Link:
https://yomi.yoroi.company/submissions/79d53f943bc31422487463c4990423e0aeb8960c61e8608b25222c07a4066319

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defedner features
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:XOREngine_Misc_XOR_Func
Create hunting rule
Author:smiller cc @florian @wesley idea on implementation with yara's built in XOR function
Description:Use with care, https://twitter.com/cyb3rops/status/1237042104406355968

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 79d53f943bc31422487463c4990423e0aeb8960c61e8608b25222c07a4066319

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1892580/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/214790/

Comments