MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91d3770ac0d4463cb356327db2c492f1cbce42715dbcae11d8768f4bf2fb2c98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91d3770ac0d4463cb356327db2c492f1cbce42715dbcae11d8768f4bf2fb2c98
SHA3-384 hash: 61bbec3324e83caca2288a298ceedf6ce73b78e9b4ec1d228c12721076c29e056203addad534cb3b35dfac05e68db505
SHA1 hash: 20b8bc062fd6b9d3974f953ce48d5aff063c9c35
MD5 hash: 4ffe0c34306dcaf1d08f9208dc59439d
humanhash: fruit-salami-item-sweet
File name:u.exe.6.dr
Download: download sample
File size:3'134'112 bytes
First seen:2021-05-01 13:38:29 UTC
Last seen:2021-05-01 14:43:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6ed4f5f04d62b18d96b26d6db7c18840 (230 x SalatStealer, 78 x BitRAT, 42 x RedLineStealer)
ssdeep 49152:QdMuktFMGWmRG5WHTk3rkKxbLjPlmZW/AICICqjXoFkDD4ecPL9KLESyz4wZSLK:QdMLtFLtQ3rkyPVoIC0qkQecPhKwSWY
Threatray 7 similar samples on MalwareBazaar
TLSH 52E5239A28334506D22937FE4DBFDE569F2D5E04EA898E0361B0B1827971CDFED140AD
Reporter j_dubp

Intelligence

File Origin
# of uploads :
2
# of downloads :
194
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://git.io/umexe
Verdict:
Malicious activity
Analysis date:
2021-04-30 14:10:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8f8c51bb-24b4-4029-995e-6c228fdf608d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/147855/
Detection(s):
SecuriteInfo.com.PUA.Tool.UltraSurf.21.25254.13360.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Setting a new proxy server as a default one
Enabling the use of the proxy server
Sending a custom TCP request
Creating a window
Creating a file in the %temp% directory
Sending a UDP request
Launching a process
Creating a process with a hidden window
Connection attempt
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
bank.adwa
Score:
51 / 100
Link:
https://www.joesandbox.com/analysis/706256
Signature
Enables a proxy for the internet explorer
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sets a proxy for the internet explorer
Sigma detected: rundll32 run dll from internet
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/91d3770ac0d4463cb356327db2c492f1cbce42715dbcae11d8768f4bf2fb2c98/
Threat name:
Win32.PUA.WinGoUltraReach
Create hunting rule
Status:
Malicious
First seen:
2021-04-13 11:13:15 UTC
AV detection:
8 of 29 (27.59%)
Threat level:
  1/5
Verdict:
malicious
Similar samples:
43c222eea7f1e367757e587b13bf17019f29bd61c07d20cbee14c4d66d43a71f
5dc4c9f9b91f1d349aa12569b1c9e792710adbc5d8e200b89f92c920008901fc
6651e6156af086e120114fb83b10af8b07acac4b73998cf5758bb5fe17677bfc
7c84f12d1931043664fde0954a5af1b0e30edd8f7fcc6b33cfe298fc431baa84
987506b904adf02794b1c51f8b166aa4ea284454607e133ef0d5d003aba64b00
af7e5864c9e4b6c0161231a1be5822505ba84eb55e0185693ef5835954c98a21
cf76d84527415e188f5954b3c7289ad60f3b36ad0aedb913c53cf398243609a9
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/210501-vlk5glnr4n/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Checks computer location settings
Unpacked files
SH256 hash:
52ba9bce611b09fe99bc8604c48384e6499b91e04ac56fa8fe6c2dcf510b9e23
MD5 hash:
4eab4beefcd48063b7a62cad99a55c10
SHA1 hash:
74e15305058cac19060d2168233434be1239f233
Link:
https://www.unpac.me/results/4cde35bb-f80c-4798-b377-8fdc4b515d24/
SH256 hash:
91d3770ac0d4463cb356327db2c492f1cbce42715dbcae11d8768f4bf2fb2c98
MD5 hash:
4ffe0c34306dcaf1d08f9208dc59439d
SHA1 hash:
20b8bc062fd6b9d3974f953ce48d5aff063c9c35
Link:
https://www.unpac.me/results/4cde35bb-f80c-4798-b377-8fdc4b515d24/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
CoinMiner
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/91d3770ac0d4463cb356327db2c492f1cbce42715dbcae11d8768f4bf2fb2c98

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

anyrun
any.run
https://app.any.run/tasks/667978dc-fe2f-468d-8e39-17cf0c5fb974
Cape
Cape
https://www.capesandbox.com/analysis/147855/

Comments