MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91d8dbc511709b9b8c9fb4ff155cee4ea09299a23096f949812f600abbf0c1b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Sytro


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91d8dbc511709b9b8c9fb4ff155cee4ea09299a23096f949812f600abbf0c1b4
SHA3-384 hash: ed8e2b10a2ca56b6fb074e75f9bcc0e8e2011041faf766ed17074682b9dbf00f3e0165f8d9a5f6040781bb3f5cf38490
SHA1 hash: bc9c7f18a45dd317e24f331d2b0b2c62527b4ce8
MD5 hash: 7a53e9bb5fc0e94402a99a564a47b917
humanhash: early-pluto-carbon-wyoming
File name:a9e3215307e4d2bbe2ee2c75821ac65f
Download: download sample
Signature Sytro
Create hunting rule
File size:64'661 bytes
First seen:2020-11-17 15:54:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ff63dc9c65eb25911a9bc535c8f06ad0 (62 x Sytro)
ssdeep 1536:zHoSCdeVMCT6ggMw4Y7FgG2xV89mTr39w6XJJzVt/Derxn:zHoLde/OgV432UcP39hXJZn/aFn
Threatray 23 similar samples on MalwareBazaar
TLSH 3453013BA34298EFC694A374BB63F32B65B20C6A1F1517534C241B7B57865CF80A432A
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

Win.Worm.Soltern-1
Create hunting rule

Win.Worm.Sytro-6803948-0
Create hunting rule

Win.Worm.Sytro-9640596-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Creating a file in the Windows directory
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/543538
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates files with lurking names (e.g. Crack.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/91d8dbc511709b9b8c9fb4ff155cee4ea09299a23096f949812f600abbf0c1b4/
Threat name:
Win32.Worm.Sytro
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 16:04:24 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
182e3d4b24640d22a78c5625a9abd0f00f59332233ea35e6418c4d0f08832639
Sytro
228e569997857ac4e2682561bac13ad534f5ae98c0369874ae582cac17c63889
Sytro
2ea0c63e38e2806812057385443a5253c269764c33449f84ae52bafc3ad45acc
Sytro
40a5664e3b37ce93e0cff5d5fff0ec17035246fa3c732e78133ec46a4e1664ad
Sytro
90b86965b599abaf095c723c9c354213e39c5633973e6ae383a9ba1afa511a06
Sytro
a7133f50657c42bb32b6c91205d6f2e3b8a983958f417f46bab8ac7ab955d010
Sytro
bd05c16d48b2a0abfc57c2b57844b273cea725c3ecf83d3e4d7fc9b995046aab
Sytro
bfc13b16a87f57ac09090e30ea47e1ca3a46cf2818af733a38662fce4bf0d69b
Sytro
c0c7e14d47b101ea76338ef3f77f43d9b53e5f90c7d1ce599c05b6a528c47c21
Sytro
cb869c32bc4d4a5d9e49f9727aca8c4d49b01391d4c8774a7146c55d64ac0078
Sytro
+ 13 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
91d8dbc511709b9b8c9fb4ff155cee4ea09299a23096f949812f600abbf0c1b4
MD5 hash:
7a53e9bb5fc0e94402a99a564a47b917
SHA1 hash:
bc9c7f18a45dd317e24f331d2b0b2c62527b4ce8
Link:
https://www.unpac.me/results/6b696d5c-e7f0-458e-94fc-a5ecfcb327e3/
SH256 hash:
08cabf85b06191132c323a4a1ebcd237f43b8b21f2d252d5937afc2e4aa2ee98
MD5 hash:
b367684eed2ddccfeafc702df3451210
SHA1 hash:
9f67cf7cb7fc9b6ab51ea6b7c929b172a21c702e
Link:
https://www.unpac.me/results/6b696d5c-e7f0-458e-94fc-a5ecfcb327e3/
SH256 hash:
cf13748798a4c1da7300a8050f4186bc67fb0b71fde4cccdc1c433dda24f1c8d
MD5 hash:
c8c9cdb96436a226ec81c1046bfed704
SHA1 hash:
836cada6678e01ed465cdf815509bfc8ebdd3877
Link:
https://www.unpac.me/results/6b696d5c-e7f0-458e-94fc-a5ecfcb327e3/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments