MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b2ad76fd9b5620ef5b6f3b6141060469adb113ef7f57a4b43991dc379224fa6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b2ad76fd9b5620ef5b6f3b6141060469adb113ef7f57a4b43991dc379224fa6
SHA3-384 hash: 43000c94170fff66175d073fe4cdc6e33e6c89b41eee4ad14be4d629412f030b229f91014cddb1628155e5743851f19d
SHA1 hash: dbfb86eff9d7d6d3c73f20c7b2899f816af15279
MD5 hash: 00a799aac7d8306ea1bf84ade053caca
humanhash: bluebird-ceiling-high-queen
File name:8b2ad76fd9b5620ef5b6f3b6141060469adb113ef7f57a4b43991dc379224fa6
Download: download sample
File size:1'136'657 bytes
First seen:2020-11-07 18:31:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 24576:JanwhSe11QSONCpGJCjETPlPXWZ5PbcmC3f/DFNkTQbd:knw9oUUEEDl+7jcmWH/xbd
Threatray 111 similar samples on MalwareBazaar
TLSH AD35236519397CDAC3B8253C20D10D00866DDBAA944CADB1A3E217D31F7A7EF3D6A50E
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Eati-7331386-0
Create hunting rule

Win.Malware.Eati-7331431-0
Create hunting rule

Win.Malware.Eati-7331499-0
Create hunting rule

Win.Malware.Eati-7331637-0
Create hunting rule

Win.Malware.Eati-7331642-0
Create hunting rule

Win.Malware.Eati-7332809-0
Create hunting rule

Win.Trojan.Mansabo-9670631-0
Create hunting rule

Win.Trojan.Mansabo-9787656-0
Create hunting rule

Win.Trojan.Mansabo-9787658-0
Create hunting rule

Win.Trojan.Mansabo-9787665-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the system32 directory
Creating a process from a recently created file
Creating a window
Result
Verdict:
MALICIOUS
Details
Base64 Encoded Powershell Directives
Detected one or more base64 encoded Powershell directives.
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b2ad76fd9b5620ef5b6f3b6141060469adb113ef7f57a4b43991dc379224fa6/
Gathering data
Verdict:
malicious
Similar samples:
13667895d952d43a44d7b2bb57abdd637668c236c39a96d73db6abac2f7ae56d
1d7d407373486969a62a5065b100778cf372553887d5b86277994cb927883317
1f39a2d168cf2fe25fddc7ff3026e356f1f81cc8bdf11d57051b991fe8985b2c
1fea4184fd49bc45c6f69a0dcf92439214b19ecf9f7c4ccfdf6b250f923989b3
2c9df010eb7c37323ed6b2ee6e23078e80055ce35da1ac9c0bf4ea7d2bd5a334
6ced2a55d8fb09e055d45be4d63c4afdb5827d681daad738e7da7d23f2bbaafe
9504b3b1cf0c21196ec76fc281c2fbc82a183fedfa49c203fa9f2b5d4477a255
a4e59301bce27c3918830555fc93e4353c3acb61e87ec1f47d43ecb7eb2e994b
b9c14334edff8f0afc962b3838680e07ed7d4ee354c73361e8b767d31a110bc7
fe6a6de7774c915bb7277284d3afe97ed7370ee4f4ad7060ebff866eecdb4fd1
+ 101 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201108-683kescevs/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments