MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 937636dcc1943a63556e24db2fe6e9922d77f2999e4cd747151f70d5def03d4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 937636dcc1943a63556e24db2fe6e9922d77f2999e4cd747151f70d5def03d4c
SHA3-384 hash: 666d2d93ed3a0a75b6a7f1214673f1a8809417bd5f4c61a0f948b2bb46f204b22343348f13df7ba45fe41dcbae126823
SHA1 hash: b837169b524c5d29904393a40a3e348612a11986
MD5 hash: c83988fdeae9dba8d542f2d122e034ba
humanhash: alaska-lamp-kitten-virginia
File name:c83988fdeae9dba8d542f2d122e034ba
Download: download sample
File size:4'097'632 bytes
First seen:2021-06-24 08:29:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a781462b9ac82bb340f6d3cc965c6b76
ssdeep 49152:Jp9YbZSHINJeR1kd0f942dPXNa4XRH96:/9Yb8IbeuIZXzRH
Threatray 821 similar samples on MalwareBazaar
TLSH 9D16069633A31AD8D42584BC8B12F02FA7A3FCB87A546B1B35D9B17A9533801FE53714
Reporter zbetcheckin
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c83988fdeae9dba8d542f2d122e034ba
Verdict:
No threats detected
Analysis date:
2021-06-24 08:38:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2b4e8141-1759-44fa-aaaf-d42b3d5590ea

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/167902/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader32.59441.6174.54.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/44059fd9-06b0-4c14-93f8-1475a7c638d1
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/807287
Signature
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (changes PE section rights)
Hides threads from debuggers
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sample or dropped binary is a compiled AutoHotkey binary
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/937636dcc1943a63556e24db2fe6e9922d77f2999e4cd747151f70d5def03d4c/
Threat name:
Win64.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-06-16 10:33:19 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
01469064718c89b6853365f1c7008c72ccd6a1ecb88a52cfcf82880e39dd0358
0ebab35c1d6c8bdfc810aa740f9038ce35e578d294c70df70686a3a3082d8332
3cce75ee3c597c77dc463f1769ec04cee91b29761fa4497bc7fffd8e3712cbe7
58813f984233cfb9eef1c9abefa7f58e96989dd9d6ebd903d40dc2cf3d56c5e8
593f9422a79559ab792b98a272ebd5db883b8a85f34de6a6f05f1c900b221dc5
9f270ac39c512c05aeb9e502738dbbc438a6f95596ec041333b7ae7e334e9c2b
b64b8d6ed783256668905a1347aabd325abd166ef465509e82e7c4e8c3d00166
ef9b7f99346ac5307323163c42c1c5d1e63143287677c551db77403165346d96
f587e0f32012fccf9a735edc91cb29d4853a7355d6fa3a1af94f2219884be447
fc1c966dd0ac73c1e2aae4287b1480ba9d27d01accc069a9a69d2a4fc9f1a6a9
+ 811 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion themida trojan
Link:
https://tria.ge/reports/210624-j5e2wd5kan/
Behaviour
Modifies system certificate store
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Checks BIOS information in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
937636dcc1943a63556e24db2fe6e9922d77f2999e4cd747151f70d5def03d4c
MD5 hash:
c83988fdeae9dba8d542f2d122e034ba
SHA1 hash:
b837169b524c5d29904393a40a3e348612a11986
Link:
https://www.unpac.me/results/e9d6cdf6-0cde-403f-b2bf-44c5f8184bbf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/937636dcc1943a63556e24db2fe6e9922d77f2999e4cd747151f70d5def03d4c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:INDICATOR_SUSPICIOUS_AHK_Downloader
Create hunting rule
Author:ditekSHen
Description:Detects AutoHotKey binaries acting as second stage droppers

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 937636dcc1943a63556e24db2fe6e9922d77f2999e4cd747151f70d5def03d4c

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/167902/
  
URLhaus
https://urlhaus.abuse.ch/url/1394094/

Comments