MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f1f9491efaf9890a6e2c8ce0b8479c97fa9519e5b977da66b1ef605c3cbc840. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f1f9491efaf9890a6e2c8ce0b8479c97fa9519e5b977da66b1ef605c3cbc840
SHA3-384 hash: 957893c73903f0d809a01fb7ee632cfccef08c4794faf4f134d065a29a9da5db730501a232683d7eb854e62f641f926c
SHA1 hash: a9ca954f3c04b679597a783e9176ea9a2cfb8832
MD5 hash: 684763488ba9fe2b944963157e432817
humanhash: texas-louisiana-autumn-apart
File name:SecuriteInfo.com.Trojan.GenericKD.43447317.762.1337
Download: download sample
File size:5'786'112 bytes
First seen:2020-12-26 11:37:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2984c7dea4825f0dad1791d137066ac5
ssdeep 98304:5h/8BnkEBIwBV/tMkvkLxdbP87zwgc8BfcQCOSy6aNp0A7i/RQgXm:7/8F+wz/fcDD+z/PfcJHWNahRRX
Threatray 1 similar samples on MalwareBazaar
TLSH CF4633F09D632C33E8009BB9CA2255A3A0579AD478DF05B4FA3C768B098E7755247E73
Reporter SecuriteInfoCom

Intelligence

File Origin
# of uploads :
1
# of downloads :
284
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Cyberpunk 2077.zip
Verdict:
Malicious activity
Analysis date:
2020-12-09 23:29:25 UTC
Tags:
rat redline trojan evasion loader
Link:
https://app.any.run/tasks/86c6bb08-0807-4ac2-9736-dc4b9e33b769

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/109502/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43447317.762.1337.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/570183
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 334151 Sample: SecuriteInfo.com.Trojan.Gen... Startdate: 26/12/2020 Architecture: WINDOWS Score: 48 34 Multi AV Scanner detection for submitted file 2->34 7 loaddll64.exe 1 2->7         started        process3 process4 9 rundll32.exe 7->9         started        11 rundll32.exe 7->11         started        13 rundll32.exe 7->13         started        15 8 other processes 7->15 process5 17 WerFault.exe 9 9->17         started        20 WerFault.exe 9 11->20         started        22 WerFault.exe 20 9 13->22         started        24 WerFault.exe 9 15->24         started        26 WerFault.exe 9 15->26         started        28 WerFault.exe 9 15->28         started        30 2 other processes 15->30 dnsIp6 32 192.168.2.1 unknown unknown 17->32
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f1f9491efaf9890a6e2c8ce0b8479c97fa9519e5b977da66b1ef605c3cbc840/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-04-07 09:12:45 UTC
AV detection:
9 of 28 (32.14%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
027804e5b1ae1c1a29104a7bada32bf72188005e8776b37e888ca931f6269b55
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201226-sd3fh4x4me/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
8f1f9491efaf9890a6e2c8ce0b8479c97fa9519e5b977da66b1ef605c3cbc840
MD5 hash:
684763488ba9fe2b944963157e432817
SHA1 hash:
a9ca954f3c04b679597a783e9176ea9a2cfb8832
Link:
https://www.unpac.me/results/d2c4f1ea-cb2e-4bb6-84db-193c3293add2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8f1f9491efaf9890a6e2c8ce0b8479c97fa9519e5b977da66b1ef605c3cbc840

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 8f1f9491efaf9890a6e2c8ce0b8479c97fa9519e5b977da66b1ef605c3cbc840

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/942358/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/109502/

Comments