MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ecd99368b83efde6f0d0d538e135394c5aec47faf430e86c5d9449eb0c9f770. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ecd99368b83efde6f0d0d538e135394c5aec47faf430e86c5d9449eb0c9f770
SHA3-384 hash: 725f849ae3af5a9df6a7db56b91261578a441371fde2c889aef014e131caa7d9cf77270e3b67f8760dcb5d726ecfebd1
SHA1 hash: 09cd2fd8de9b4968c9ea154c5f71c3273fc74087
MD5 hash: d0e763139d8ae4919323f584a1750cfe
humanhash: stream-iowa-purple-east
File name:d0e763139d8ae4919323f584a1750cfe.exe
Download: download sample
File size:48'056 bytes
First seen:2021-10-19 15:16:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 768:bmQrdv6/8dQcw/s1R/hwZZ77qnQRjKAIub31WIxt0hf:i6v6/82cw/aKVNKVuL0IxtW
Threatray 569 similar samples on MalwareBazaar
TLSH T16D23AE22AB9C423ADB630F3954F49100573C63C62A86CB2E2A51E05D7FD77971B123BE
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
286
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Spynet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/198616/
Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed packed
Link:
https://www.filescan.io/uploads/616ee1719a5a1e91c5c6c17a/reports/e57efb20-5095-41e2-88cf-0dadd702f9bd/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a883955e-455c-4e61-baa8-bfa49d7c16f6
Result
Threat name:
Covid19 Cryptolocker
Create hunting rule
Detection:
malicious
Classification:
rans.spre.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/873352
Signature
Adds a directory exclusion to Windows Defender
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to detect sleep reduction / modifications
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious names
Drops executable to a common third party application directory
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Found Tor onion address
Hides threads from debuggers
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Defender Exclusion
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Covid19 Ransomware
Yara detected Cryptolocker ransomware
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 505776 Sample: r1Mbe8COJc.exe Startdate: 19/10/2021 Architecture: WINDOWS Score: 100 73 Multi AV Scanner detection for submitted file 2->73 75 Yara detected UAC Bypass using CMSTP 2->75 77 Yara detected Covid19 Ransomware 2->77 79 6 other signatures 2->79 7 r1Mbe8COJc.exe 23 10 2->7         started        12 svchost.exe 2->12         started        14 svchost.exe 2->14         started        16 4 other processes 2->16 process3 dnsIp4 69 cdn.discordapp.com 162.159.133.233, 443, 49751, 49755 CLOUDFLARENETUS United States 7->69 59 C:\Windows\Resources\Themes\...\svchost.exe, PE32 7->59 dropped 61 C:\Windows\...\svchost.exe:Zone.Identifier, ASCII 7->61 dropped 63 C:\Users\user\AppData\...\r1Mbe8COJc.exe.log, ASCII 7->63 dropped 65 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 7->65 dropped 85 Creates autostart registry keys with suspicious names 7->85 87 Creates an autostart registry key pointing to binary in C:\Windows 7->87 89 Adds a directory exclusion to Windows Defender 7->89 97 3 other signatures 7->97 18 r1Mbe8COJc.exe 7->18         started        22 AdvancedRun.exe 7->22         started        25 powershell.exe 25 7->25         started        33 3 other processes 7->33 71 162.159.135.233, 443, 49787, 49789 CLOUDFLARENETUS United States 12->71 91 System process connects to network (likely due to code injection or exploit) 12->91 93 Hides threads from debuggers 12->93 27 powershell.exe 12->27         started        29 powershell.exe 12->29         started        31 powershell.exe 12->31         started        95 Changes security center settings (notifications, updates, antivirus, firewall) 16->95 file5 signatures6 process7 dnsIp8 51 C:\ProgramData\Adobe\Setup\...\setup.exe, data 18->51 dropped 53 C:\...\RdrServicesUpdater2_1901220035.exe, data 18->53 dropped 55 C:\ProgramData\Adobe\...\AdobeARMHelper.exe, data 18->55 dropped 57 2 other files (none is malicious) 18->57 dropped 81 Drops executable to a common third party application directory 18->81 83 Infects executable files (exe, dll, sys, html) 18->83 67 192.168.2.1 unknown unknown 22->67 35 AdvancedRun.exe 22->35         started        37 conhost.exe 25->37         started        39 conhost.exe 27->39         started        41 conhost.exe 29->41         started        43 conhost.exe 31->43         started        45 conhost.exe 33->45         started        47 conhost.exe 33->47         started        49 conhost.exe 33->49         started        file9 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ecd99368b83efde6f0d0d538e135394c5aec47faf430e86c5d9449eb0c9f770/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-10-19 15:17:05 UTC
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1ae52558dadc5c5b388c0a64b6e54ead3280540b5a1db2d90f20d960257004dd
32016cf36c5e99a6c8fba8fd4ffad8b5f301cac55439ae73fec5db799ac341ab
368800079ca773a707d437855a41fa422f7337f3a9f36aff4f974301dd801089
4fa82bcc428147d23e5abc86fb9bfdc61829d91094659e74250ac43ab9a73ab4
60c65307f80b12d2a8d8820756e900214ad19a1fcfcda18cdbee3a25974235ac
b215d5e7cf39628497363e29d2dce0475e7180da848f7f6032d1187c78fd16bf
c9250592c7cf1d5226a5cad25a83532deaba0cf18b079c194c58ad182d59b283
cda57d12ed16414f52bfcfe2f3234d0fa5eb259aa20a59568cf040f6958047eb
daa69519885c0f9f4947c4e6f82a0375656630e0abf55a345a536361f986252e
f9397a0438f1e3a8d03aa326dc4910482df49dd295228d9a4dda1f55247fd6e3
+ 559 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion ransomware trojan
Link:
https://tria.ge/reports/211019-sn192ahabk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Drops desktop.ini file(s)
Enumerates connected drives
Windows security modification
Executes dropped EXE
Nirsoft
Turns off Windows Defender SpyNet reporting
Windows security bypass
Unpacked files
SH256 hash:
8ecd99368b83efde6f0d0d538e135394c5aec47faf430e86c5d9449eb0c9f770
MD5 hash:
d0e763139d8ae4919323f584a1750cfe
SHA1 hash:
09cd2fd8de9b4968c9ea154c5f71c3273fc74087
Link:
https://www.unpac.me/results/56094bc7-38a0-45df-97a4-a76e84831b21/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8ecd99368b83/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8ecd99368b83efde6f0d0d538e135394c5aec47faf430e86c5d9449eb0c9f770

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 8ecd99368b83efde6f0d0d538e135394c5aec47faf430e86c5d9449eb0c9f770

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1691232/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/198616/

Comments