MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Hakbit


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e
SHA3-384 hash: d4ed23b5bbfed4f8449b29471120fd5e491a39a9bde689ccfb31f3a6dcee670c900b4cae35c85d978cb48502faffb4d7
SHA1 hash: 0ecff2f818565e7eb28d3a7b7d295459a868e920
MD5 hash: 21fa6ebdd397f14bbb68a4e3d012467e
humanhash: magnesium-october-bulldog-jersey
File name:weather.exe
Download: download sample
Signature Hakbit
Create hunting rule
File size:425'984 bytes
First seen:2020-04-26 08:43:38 UTC
Last seen:2020-04-26 09:41:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 1536:B0faGpWzs3ORz1Cxcs7ivPh9tl2jzQS8svM4CoLT6QPbBPD+HFMcNv74wAqSfj41:mxcs+B9tl2jzQSvD+vNv3f
Threatray 13 similar samples on MalwareBazaar
TLSH 7D9470322E43C004D8AE4FB0FD66E2C64F9A6CD915A4F2652CFDB2690DB0E4B4A4177D
Reporter cocaman
Tags:exe Hakbit Ransomware

Intelligence

File Origin
# of uploads :
2
# of downloads :
2'029
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.479532.25599.6354.UNOFFICIAL
Create hunting rule

Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/374691
Signature
Disables the Windows task manager (taskmgr)
Disables Windows Defender (via service or powershell)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 239423 Sample: zYsOpivtMK Startdate: 17/06/2020 Architecture: WINDOWS Score: 80 39 Multi AV Scanner detection for domain / URL 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected AsyncRAT 2->43 45 3 other signatures 2->45 7 zYsOpivtMK.exe 1 3 2->7         started        process3 dnsIp4 37 121.205.6.0.in-addr.arpa 7->37 47 Disables Windows Defender (via service or powershell) 7->47 49 Disables the Windows task manager (taskmgr) 7->49 11 net.exe 7->11         started        13 net.exe 7->13         started        15 powershell.exe 22 7->15         started        17 14 other processes 7->17 signatures5 process6 process7 19 conhost.exe 11->19         started        21 net1.exe 11->21         started        23 conhost.exe 13->23         started        25 net1.exe 13->25         started        27 conhost.exe 15->27         started        29 conhost.exe 17->29         started        31 conhost.exe 17->31         started        33 conhost.exe 17->33         started        35 10 other processes 17->35
Gathering data
Threat name:
Win32.Trojan.Hakbit
Create hunting rule
Status:
Malicious
First seen:
2020-04-24 15:53:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qhub6c533obr5wrbkaz3pj636lxnhajpjzmbddyydkhjtzqtc6pa._file
Verdict:
suspicious
Similar samples:
094157797d5445aeefe736030d14515e4cfe9478a52a9f6911728b2e6e343b45
Hakbit
1267b822cde1edabfc063458232a5ed9ea03652416de96b8d12ecb1058c86e23
Hakbit
29e9bb0fe606371bd16d7f1476e089c9bf463caf5cd2c67ac2b3f1148e760a03
Hakbit
35905f2246cb7409a599bcee3dde1737f751e83996753f7f6cce1d3d4148df2e
Hakbit
385be4267e9aaadfb82815d54dde7fccbd0d1b843aa3c4062ef752a9378ae02e
Hakbit
3e5ee9e4d00a17bd606a38740500770ddc552e664e3b02770d9897b3ba4423b3
Hakbit
4984825fb21206a2f2df5d2c84794f0ac4edea3c48d32e9284338d7082d55024
Hakbit
a860b7f6787c55f457249bf722d6ce93034391889c05f6ec0c9e10befe8c8c03
Hakbit
abe31666e7b408ed139ba7452f70d3f633b7cc7ce0de9de8b8c6489f47a34df8
Hakbit
cc32eb0fb5c35376f69a3d6b81fdb339309d06d80a2cffa2604e21012ac33c18
Hakbit
+ 3 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
anyrun
any.run
https://app.any.run/tasks/1dab8d3e-7bbc-4fc7-a6d1-43a8b4cfdcc1/
  
X
https://twitter.com/fbgwls245/status/1254321690256879621

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments