MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 934c7ccf26fe121853954d916beedaa760af5ede01cfe54d7776aa6489c29ac8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	934c7ccf26fe121853954d916beedaa760af5ede01cfe54d7776aa6489c29ac8
SHA3-384 hash:	aece8a5baff80a578d6b8027ba11aa37b3750f9994fcd2badd299ba8df98cf173e5f56a999082ecd1b9b51f6d51d1531
SHA1 hash:	77965d904077bee845d5482bdcf149499e5cfd24
MD5 hash:	6e6a747dffc7f4bd0fcca8d3547205d9
humanhash:	sad-twelve-cold-summer
File name:	6e6a747dffc7f4bd0fcca8d3547205d9.exe
Download:	download sample
File size:	4'591'616 bytes
First seen:	2022-03-03 09:37:54 UTC
Last seen:	2022-03-23 21:24:14 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	22a7d193681235f08e33cfcfbc112896 (2 x CoinMiner)
ssdeep	98304:TedkkwNo6SBPHLH4ZRB8WPdlFn9wvypbt7tWhsOLDL:SQNo6STYZ4WPdlF9wKhWmoD
TLSH	T1E126336AF49D9AB2DE35997A4E7F261DC50B78224473511873128FCC40AB3B90EB7873
Reporter	abuse_ch
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

203

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/246893/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.48332868.11304.7433.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a window

Searching for synchronization primitives

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ebe813c9-1bcd-490c-adeb-44f6bac4248c

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/950196

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

PE file has nameless sections

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/934c7ccf26fe121853954d916beedaa760af5ede01cfe54d7776aa6489c29ac8/

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2022-02-13 04:05:53 UTC

File Type:

PE+ (Exe)

AV detection:

15 of 42 (35.71%)

Threat level:

5/5

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220303-ll4h2scagm/

Unpacked files

SH256 hash:

934c7ccf26fe121853954d916beedaa760af5ede01cfe54d7776aa6489c29ac8

MD5 hash:

6e6a747dffc7f4bd0fcca8d3547205d9

SHA1 hash:

77965d904077bee845d5482bdcf149499e5cfd24

Link:

https://www.unpac.me/results/1995211c-a10b-4d05-bd0a-f19d2c16763f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.19

Link:

https://yomi.yoroi.company/submissions/934c7ccf26fe121853954d916beedaa760af5ede01cfe54d7776aa6489c29ac8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	XOREngine_Misc_XOR_Func Create hunting rule
Author:	smiller cc @florian @wesley idea on implementation with yara's built in XOR function
Description:	Use with care, https://twitter.com/cyb3rops/status/1237042104406355968