MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75
SHA3-384 hash: ec9bf5a8e9f1f207b1ee2fd5487d4ec1e381a9effbd67c965c45425d9997e83a1845859af3c24af256596b22f99fbbb6
SHA1 hash: 3d311117d09f4a6ad300e471c2fb2b3c63344b1d
MD5 hash: 20183332c370b9d35d368083ecb74d22
humanhash: avocado-beer-lamp-india
File name:Delfino.exe
Download: download sample
File size:1'254'696 bytes
First seen:2020-11-19 10:37:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash baa93d47220682c04d92f7797d9224ce (139 x RiseProStealer, 26 x Xtrat, 18 x CoinMiner)
ssdeep 24576:m/hQQsEc0S6YXTFuInaf/jEqVasbIh8e2us1F/IE4dkTSz3lCk:mmaS6EEIa3Ppb1V/3yIk
Threatray 1 similar samples on MalwareBazaar
TLSH B64533D058CF3C99ED8AEF704BF7B135661A324B1126CD9B0CAC9C4931F915A2A62737
Reporter JAMESWT_WT

Code Signing Certificate

Organisation:ALEXIS SECURITY GROUP
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:Jul 8 00:00:00 2019 GMT
Valid to:Jul 7 23:59:59 2020 GMT
Serial number: B7F19B13DE9BEE8A52FF365CED6F67FA
Thumbprint Algorithm:SHA256
Thumbprint: 787F9D22F0EB786BBBF83584428BD401FCBF3956D6E8729FE75CC9ABB123AE71
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.EXE.Obfus-4.UNOFFICIAL
Create hunting rule

PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
DNS request
Connection attempt
Sending an HTTP POST request
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
46 / 100
Link:
https://www.joesandbox.com/analysis/542772
Signature
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Potentially malicious time measurement code found
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75/
Threat name:
Win32.Trojan.NukeSped
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 11:02:35 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
6369b1ed4ab77dfaea18de4beb22c0ca26bd91eae120261c3657f079f88c1790
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion persistence
Link:
https://tria.ge/reports/201119-vajt7y6phs/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Enumerates system info in registry
Modifies Control Panel
Suspicious use of SetWindowsHookEx
Program crash
Drops file in Windows directory
Modifies service
Suspicious use of NtSetInformationThreadHideFromDebugger
Enumerates connected drives
Checks BIOS information in registry
Identifies Wine through registry keys
Modifies Installed Components in the registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
91f6fdf97a9aab278ec63156a8deeca616abb968c81a14dc5713d9918f7eeb75
MD5 hash:
20183332c370b9d35d368083ecb74d22
SHA1 hash:
3d311117d09f4a6ad300e471c2fb2b3c63344b1d
Link:
https://www.unpac.me/results/0f108053-981e-46ef-866d-89cca2ee3346/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments