MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7f6c28303efba53285eab22d2c26aa3688397cabf95947b7877a0d3bc8ab38a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | 7f6c28303efba53285eab22d2c26aa3688397cabf95947b7877a0d3bc8ab38a6 |
|---|---|
| SHA3-384 hash: | d0f0dc4a82a0cbfe3800dec8cbc19b69fe2333496522abd469a8f7dadca6c9a3e6afe920a2f1f1850f41fcd4c2ad98dc |
| SHA1 hash: | be1d10f369c315909946390ac1a5525370571a86 |
| MD5 hash: | 1c4c4e8b7a0e84e698d50877c51242f3 |
| humanhash: | happy-iowa-early-early |
| File name: | 7f6c28303efba53285eab22d2c26aa3688397cabf95947b7877a0d3bc8ab38a6 |
| Download: | download sample |
| File size: | 32'256 bytes |
| First seen: | 2021-09-06 11:13:04 UTC |
| Last seen: | 2021-09-06 11:18:15 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| ssdeep | 384:6dlKJehwX5lbmiw+yxZFSwNpG54jwaALc4ssoeja3khnpwKNsw1lZvStrBYOltO:6dlKJcYzbmiM3FpvjwaAQchcwjQMO |
| Threatray | 3 similar samples on MalwareBazaar |
| TLSH | T1FBE2AE425A20A463DEC744B4F2EB5E265C78670097D0C5D3A190D1E8DF88BE6F93D42B |
| Reporter |  JAMESWT_WT |
| Tags: | exe Ginger Communication Hub d.o.o. x509 Certificates |
Intelligence
File Origin
# of uploads :
2
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7f6c28303efba53285eab22d2c26aa3688397cabf95947b7877a0d3bc8ab38a6
Verdict:
Malicious activity
Analysis date:
2021-09-06 11:19:28 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file
Launching a process
Sending a custom TCP request
Sending a UDP request
Launching cmd.exe command interpreter
Connection attempt
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Creates an autostart registry key pointing to binary in C:\Windows
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2021-09-02 21:20:31 UTC
File Type:
PE (Exe)
AV detection:
21 of 28 (75.00%)
Threat level:
5/5
Result
Malware family:
n/a
Score:
8/10
Tags:
persistence
Behaviour
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Blocklisted process makes network request
Unpacked files
SH256 hash:
21d8d07bda2e863b5119a03e5c400ba6bac9518df2f84e6ca7dcf49e2259355a
MD5 hash:
f49d1be8336b88b01d00e1dfb7362c0a
SHA1 hash:
0f07d359d985fff1e07685334b3fe4d4a031d4d5
SH256 hash:
7f6c28303efba53285eab22d2c26aa3688397cabf95947b7877a0d3bc8ab38a6
MD5 hash:
1c4c4e8b7a0e84e698d50877c51242f3
SHA1 hash:
be1d10f369c315909946390ac1a5525370571a86
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Ginger
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 7f6c28303efba53285eab22d2c26aa3688397cabf95947b7877a0d3bc8ab38a6
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.