MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f1ed07ca8c41df4a0c109f87d46e67365cd111de9ef1f17687be43c18f51e49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ShikataGaNai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f1ed07ca8c41df4a0c109f87d46e67365cd111de9ef1f17687be43c18f51e49
SHA3-384 hash: 317105750010f4562656df70017d72560a9574b1e093178c41c963a83b8b5b83acc9018a03b134227fce1859f6e876ac
SHA1 hash: f3f99387b9370621380dba402df36f371895f8f0
MD5 hash: 978e8f81632f49a13b9518a997223a66
humanhash: red-emma-oxygen-kilo
File name:ssrc.exe
Download: download sample
Signature ShikataGaNai
Create hunting rule
File size:73'802 bytes
First seen:2021-04-19 17:53:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 481f47bbb2c9c21e108d65f52b04c448 (257 x Meterpreter, 93 x Metasploit, 33 x ShikataGaNai)
ssdeep 1536:I9KgQQ4wuS7qLRYI24eIC7cjduwda8OMb+KR0Nc8QsJq39:xVwjiirg/M8Oe0Nc8QsC9
TLSH 4B73AF42E5C04436D0A2127F6BB63A769630F5FB7616C296358CCDE4DBC0DB0A6663CB
Reporter r3dbU7z
Tags:exe ShikataGaNai

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ssrc.exe
Verdict:
Suspicious activity
Analysis date:
2021-04-19 17:58:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8a179cc4-10c6-4967-bec9-39b63cfba844

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/138691/
Detection(s):
Win.Trojan.Swrort-5710536-0
Create hunting rule

Win.Trojan.MSShellcode-6360728-0
Create hunting rule

Win.Trojan.MSShellcode-6360730-0
Create hunting rule

Win.Trojan.MSShellcode-6360729-0
Create hunting rule

BC.Win.Trojan.Swrort-17210
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/687482
Signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Metasploit Payload
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f1ed07ca8c41df4a0c109f87d46e67365cd111de9ef1f17687be43c18f51e49/
Gathering data
Verdict:
unknown
Result
Malware family:
metasploit
Create hunting rule
Score:
  10/10
Tags:
family:metasploit backdoor trojan
Link:
https://tria.ge/reports/210419-n7f661b2sx/
Behaviour
MetaSploit
Malware Config
C2 Extraction:
81.69.42.250:6000
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Swrort
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8f1ed07ca8c41df4a0c109f87d46e67365cd111de9ef1f17687be43c18f51e49

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Hunting_Rule_ShikataGaNai
Create hunting rule
Author:Steven Miller
Reference:https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/138691/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-19 18:01:09 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
1) [C0019] Data Micro-objective::Check String
2) [C0026.001] Data Micro-objective::Base64::Encode Data
3) [C0026.002] Data Micro-objective::XOR::Encode Data