MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8360faeed3c802fbd78d0f31b14c5b3cdbf01edca8fdc486994d2cc1c2cd70a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8360faeed3c802fbd78d0f31b14c5b3cdbf01edca8fdc486994d2cc1c2cd70a4
SHA3-384 hash: 5115ca1284b8f3f86ab4c9203d32f86dda0b25a2ec3c2022beaedd4804097b7341609184513a95a89955574eeadc7abb
SHA1 hash: 7f871431914000e13ea1910e7d1406f57b427ca2
MD5 hash: a24348a6b769f7376dc4bdd3f96b1474
humanhash: beryllium-zebra-zebra-twelve
File name:CCleaners.exe
Download: download sample
File size:300'032 bytes
First seen:2021-03-21 23:45:45 UTC
Last seen:2021-03-22 02:01:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b6e1dc2ad786e10f356d588cdf1cf673
ssdeep 6144:M9UVJgmZwuv/sa/zKSK6y4Q5vVqbI9Wkf:aU7Rv/sa/mmavVqbI9W
Threatray 1 similar samples on MalwareBazaar
TLSH 3E548349D37E06AECAA1F3BC81023BF3D274B15135692837AE6874183A265754D7BF0E
Reporter r3dbU7z
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CCleaners.exe
Verdict:
No threats detected
Analysis date:
2021-03-21 23:47:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/693e0d87-3fe1-4d86-b9c9-fbeea1e26b6a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Program.Win32.Wacapew.Cml.5074.22186.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/86c5b31f-74f9-4908-b9d7-6a36fc9987d3
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/647218
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 372577 Sample: CCleaners.exe Startdate: 22/03/2021 Architecture: WINDOWS Score: 48 13 Multi AV Scanner detection for submitted file 2->13 6 CCleaners.exe 1 2->6         started        process3 dnsIp4 11 185.232.31.2, 2001, 49743 PINHOSTING-ASEE Estonia 6->11 9 conhost.exe 6->9         started        process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8360faeed3c802fbd78d0f31b14c5b3cdbf01edca8fdc486994d2cc1c2cd70a4/
Threat name:
Win64.Trojan.Rozena
Create hunting rule
Status:
Malicious
First seen:
2021-03-21 23:46:07 UTC
AV detection:
8 of 28 (28.57%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
7737be761cd80d49f4597b65503ed001f96dbfe669bd0112dfe3fb9c6885eeca
Result
Malware family:
metasploit
Create hunting rule
Score:
  10/10
Tags:
family:metasploit backdoor trojan
Link:
https://tria.ge/reports/210321-nqxa4x6nbx/
Behaviour
MetaSploit
Malware Config
C2 Extraction:
185.232.31.2:2001
Unpacked files
SH256 hash:
8360faeed3c802fbd78d0f31b14c5b3cdbf01edca8fdc486994d2cc1c2cd70a4
MD5 hash:
a24348a6b769f7376dc4bdd3f96b1474
SHA1 hash:
7f871431914000e13ea1910e7d1406f57b427ca2
Link:
https://www.unpac.me/results/901e2638-f7c5-48c1-8ab6-011c54161292/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/8360faeed3c802fbd78d0f31b14c5b3cdbf01edca8fdc486994d2cc1c2cd70a4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments