MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f16b5e291ccba6411c95bafc3fe7eeb5c4a57df8ba32cfd173e75cc8826c921. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f16b5e291ccba6411c95bafc3fe7eeb5c4a57df8ba32cfd173e75cc8826c921
SHA3-384 hash: 1be7decdf47dd0a39fb3ff4e297c6989b893d733080b2a268d454545c73e23fb4536ba9b4070afff719ef37ec6720a6e
SHA1 hash: 03e3c570e4a32992a2633bbff9c49793b6c1b0c3
MD5 hash: 0b422df6c3d71d2147350d11c256724e
humanhash: rugby-mars-island-summer
File name:SecuriteInfo.com.Trojan.SpyBot.958.15861.13922
Download: download sample
File size:1'984'000 bytes
First seen:2020-10-22 02:02:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6ed4f5f04d62b18d96b26d6db7c18840 (236 x SalatStealer, 78 x BitRAT, 42 x RedLineStealer)
ssdeep 49152:s9elE4UVPjJ6a4h85i0NDDRCdLDCjtcLROlri/:ojV7saA85i0NDDRCdEtlli/
Threatray 44 similar samples on MalwareBazaar
TLSH 1A95338FB929C321F5750DBBD6CD4A757083489267EC57247BD0325B0AA33C7A078A6E
Reporter SecuriteInfoCom

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/74404/
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

SecuriteInfo.com.Trojan.SpyBot.958.15861.13922.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/506511
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Potential time zone aware malware
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7f16b5e291ccba6411c95bafc3fe7eeb5c4a57df8ba32cfd173e75cc8826c921/
Threat name:
Win32.Trojan.RanumBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 20:10:50 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
22adb7035a25bc288cb78f323f52c1c33a9e5113b387644da2947a3a1512e64f
33084be03513386911655bc80a549a8aec6f8cbeef78975c0f9ae486e68b1b31
34c2eed8a266d3b5221bb51f0b5a59712b01d0b339a1db8f626688cb8fb81030
482027d0e151826c175ff084f6e76ce4ca3a920ca648fc2d5906ed0a793fe8ad
629a413c87fe43667f39e89ec6314ec471bea166444c050375b6b56e1c00907b
86fce58f93e4087e261c52befbb872ddafeb8129008d5153c90084cd4a4a45d0
8e0aea169927ae791dbafe063a567485d33154198cd539ee7efcd81a734ea325
a53bb75361e9ea43ce146e90b3a9b99ce11f2853ab1aefa0d86c1cae9d54b93c
cb1ffa5cd81d50702ee7296cd788a66fa8d5aa422e5cb4cdaca5a2ea4322141f
d5d368c9ba295ef4c36fe1e02452418d14f27512fe153c2f16f7384ca60b3db4
+ 34 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201022-3z8rd73njs/
Behaviour
UPX packed file
Unpacked files
SH256 hash:
7f16b5e291ccba6411c95bafc3fe7eeb5c4a57df8ba32cfd173e75cc8826c921
MD5 hash:
0b422df6c3d71d2147350d11c256724e
SHA1 hash:
03e3c570e4a32992a2633bbff9c49793b6c1b0c3
Link:
https://www.unpac.me/results/5293d995-54d9-4fc1-ac86-f4db518ecbdf/
SH256 hash:
a3c091d73ca799a477415934910fd53bf47b9da0466a07df170e7b0c44561070
MD5 hash:
2332e836ec8ed795a54cd5269351bb97
SHA1 hash:
2a9e91311dc521da34e5267c078331a835e13751
Link:
https://www.unpac.me/results/5293d995-54d9-4fc1-ac86-f4db518ecbdf/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 7f16b5e291ccba6411c95bafc3fe7eeb5c4a57df8ba32cfd173e75cc8826c921

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/74404/
  
URLhaus
https://urlhaus.abuse.ch/url/730491/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/731455/
  
URLhaus
https://urlhaus.abuse.ch/url/731456/
  
URLhaus
https://urlhaus.abuse.ch/url/731497/

Comments