MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ef4ea5fbf6efc41fae7887c2df200443d3709996059dea6b5e1f4250b537de9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ef4ea5fbf6efc41fae7887c2df200443d3709996059dea6b5e1f4250b537de9
SHA3-384 hash: dc4c0603019bb30b2b715689ffad0b5fdd34e67774782610ecdde80877cd92c4766bad212720394770367dc89fb45014
SHA1 hash: 78365586c3ff9263299fdd773792d9386ed9eec5
MD5 hash: 860fe6c69803d5172114f4c59093aa25
humanhash: georgia-king-tennessee-floor
File name:860fe6c69803d5172114f4c59093aa25.exe
Download: download sample
File size:5'759'488 bytes
First seen:2021-11-29 19:09:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5a09ad2b0e743cf84cef11e5c57d4515
ssdeep 49152:20wWapqaLXu53R1Kr5zX176U6RXc50gOjO3y58WZTIuF:20iMCz6D
TLSH T15C46C8528BB4C654E8A29037CD31B8F04AB27C84D2294EE36ED63D7E3E7616150AD7F4
File icon (PE):PE icon
dhash icon a38dcdc5c7fe6c3c
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
860fe6c69803d5172114f4c59093aa25.exe
Verdict:
No threats detected
Analysis date:
2021-11-29 19:18:12 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2aa08106-2a28-4f98-8656-d96a76dab6cd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Artemis860FE6C69803.13006.31140.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
DNS request
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/198/overview
Behaviour
MeasuringTime
SystemUptime
CallSleep
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61a52590c4c5314148222a53/reports/d90f9cd0-df3a-4d98-9f59-0677cc16edc3/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/33297872-6693-4c77-995f-3020c1e71bf5
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/898177
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ef4ea5fbf6efc41fae7887c2df200443d3709996059dea6b5e1f4250b537de9/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-11-24 08:52:04 UTC
File Type:
PE+ (Exe)
Extracted files:
13
AV detection:
6 of 45 (13.33%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211129-xvc81affe4/
Unpacked files
SH256 hash:
7ef4ea5fbf6efc41fae7887c2df200443d3709996059dea6b5e1f4250b537de9
MD5 hash:
860fe6c69803d5172114f4c59093aa25
SHA1 hash:
78365586c3ff9263299fdd773792d9386ed9eec5
Link:
https://www.unpac.me/results/4350b75c-83e1-4219-9464-52131f59176d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7ef4ea5fbf6efc41fae7887c2df200443d3709996059dea6b5e1f4250b537de9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:crime_win32_ransom_avaddon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Avaddon ransomware
Reference:https://twitter.com/VK_Intel/status/1300944441390370819

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 7ef4ea5fbf6efc41fae7887c2df200443d3709996059dea6b5e1f4250b537de9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1829799/
  
Delivery method
Distributed via web download

Comments