MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 868a62feff8b46466e9d63b83135a7987bf6d332c13739aa11b747b3e2ad4bbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Lazarus


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 868a62feff8b46466e9d63b83135a7987bf6d332c13739aa11b747b3e2ad4bbf
SHA3-384 hash: 2eb89218a3b8fa4a28484dcd65368fa91541dbd3436061aecbd9545356784126abfc56a7047d3722fc024d132ee25caa
SHA1 hash: ab76f74f61428d15ab4e1dacc0824d1770c34689
MD5 hash: 6e710f6f02fdde1e4adf06935a296fd8
humanhash: two-beer-arkansas-utah
File name:6e710f6f02fdde1e4adf06935a296fd8
Download: download sample
Signature Lazarus
Create hunting rule
File size:186'368 bytes
First seen:2021-01-25 21:47:18 UTC
Last seen:2021-01-25 23:51:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 738211057331e8a6894afc3561f5a798 (1 x Lazarus)
ssdeep 3072:57q8J8o4iiUkq8e12x0VcTt7+86aaNew+0R3Dhc+Dl7RMBrbHKr:57FJ8onR8lPTN+86aoePo3yfM
TLSH CA044B05736022FDE472A234CEA3C582EB71389D4775ABCF23A44275DF27AD06E39A15
Reporter c3rb3ru5d3d53c2
Tags:Lazarus

Intelligence

File Origin
# of uploads :
3
# of downloads :
223
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6e710f6f02fdde1e4adf06935a296fd8
Verdict:
No threats detected
Analysis date:
2021-01-25 21:48:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9593db95-9b0a-4d76-bbeb-5ded91bcb602

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/113802/
Detection(s):
SecuriteInfo.com.Generic.mg.6e710f6f02fdde1e.22572.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Connection attempt
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/590015
Signature
Contains functionality to capture and log keystrokes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/868a62feff8b46466e9d63b83135a7987bf6d332c13739aa11b747b3e2ad4bbf/
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210125-p7xqfx28nx/
Unpacked files
SH256 hash:
868a62feff8b46466e9d63b83135a7987bf6d332c13739aa11b747b3e2ad4bbf
MD5 hash:
6e710f6f02fdde1e4adf06935a296fd8
SHA1 hash:
ab76f74f61428d15ab4e1dacc0824d1770c34689
Link:
https://www.unpac.me/results/329ac819-b64e-41f6-902a-67a7fba0af0b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/868a62feff8b46466e9d63b83135a7987bf6d332c13739aa11b747b3e2ad4bbf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/Arkbird_SOLG/status/1353816301010120705
Cape
Cape
https://www.capesandbox.com/analysis/113802/

Comments