MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36
SHA3-384 hash: c5130ee37fec12ecec7826ae70eefdbc6e41b5a895905722611b15b4de682e0a15094f17a55fa03ea523238865010fdc
SHA1 hash: d5ff73c043f3bb75dd749636307500b60a436550
MD5 hash: 5d43baf1c9e9e3a939e5defd8f8fbd8d
humanhash: island-pennsylvania-muppet-gee
File name:867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36
Download: download sample
File size:2'198'684 bytes
First seen:2022-04-21 13:26:46 UTC
Last seen:2022-04-21 15:13:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c5a1c18637aa8a3e490652fc13e941e3
ssdeep 24576:y3SY+/2M3BMr7cdgSLBjbr4nzzy95VV7cEXV:ESZ2ESrHSV3D95oA
Threatray 1 similar samples on MalwareBazaar
TLSH T158A5B4E320D6A7EDC405D93B8603ED6B858FBCB6042794F77168B2538C35C447AA5E2E
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 3c1f5bac33339dfc (1 x RemcosRAT)
Reporter JAMESWT_WT
Tags:exe TraderTraitor

Intelligence

File Origin
# of uploads :
2
# of downloads :
228
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/265452/
Detection(s):
SecuriteInfo.com.BackDoor.NukeSped.39.6901.30115.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
cmd.exe greyware update.exe
Link:
https://www.filescan.io/uploads/62615babffe27d511923e7e7/reports/f7a987f2-4be8-4c7d-9040-a6fb27bdad25/overview
Malware family:
Lazarus
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f322f388-4ef7-47f7-8d41-266ffd17b9d0
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/980684
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found evasive API chain (may stop execution after checking mutex)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36/
Threat name:
Win64.Trojan.APost
Create hunting rule
Status:
Malicious
First seen:
2021-01-15 12:55:46 UTC
File Type:
PE+ (Exe)
Extracted files:
22
AV detection:
26 of 42 (61.90%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
90ea1c7806e2d638f4a942b36a533a1da61adedd05a6d80ea1e09527cf2d839b
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220421-qp5yhaecd9/
Unpacked files
SH256 hash:
867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36
MD5 hash:
5d43baf1c9e9e3a939e5defd8f8fbd8d
SHA1 hash:
d5ff73c043f3bb75dd749636307500b60a436550
Link:
https://www.unpac.me/results/8c7d63c0-2a4f-4234-ae9f-09e6242f1ac2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/265452/

Comments