MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9504b3b1cf0c21196ec76fc281c2fbc82a183fedfa49c203fa9f2b5d4477a255. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9504b3b1cf0c21196ec76fc281c2fbc82a183fedfa49c203fa9f2b5d4477a255
SHA3-384 hash: 5d39f56913b7102ef64ea4a5a973128c9219611d48dd15938818bdff018905ca8b20db680eed72c25d54b141fb81f4ce
SHA1 hash: d93fbe0f267b96c77b75447fa43f2302894d522c
MD5 hash: b96cb4c81729beb58ee9f2bfd37251b4
humanhash: item-lactose-montana-sweet
File name:9504b3b1cf0c21196ec76fc281c2fbc82a183fedfa49c203fa9f2b5d4477a255
Download: download sample
File size:1'334'250 bytes
First seen:2020-11-07 18:31:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 24576:JanwhSe11QSONCpGJCjETPl+XWZ5Pbcq92zjP+sjI1XPlq1i2H+:knw9oUUEEDlv7jcq4nPU1
Threatray 114 similar samples on MalwareBazaar
TLSH D35533518A2CB8CFC67806BD14861E088276C9C6D48CADF8E3E576975FFCB791E5600D
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Eati-7331386-0
Create hunting rule

Win.Malware.Eati-7331431-0
Create hunting rule

Win.Malware.Eati-7331499-0
Create hunting rule

Win.Malware.Eati-7331637-0
Create hunting rule

Win.Malware.Eati-7331642-0
Create hunting rule

Win.Malware.Eati-7332809-0
Create hunting rule

Win.Trojan.Mansabo-9670631-0
Create hunting rule

Win.Trojan.Mansabo-9787656-0
Create hunting rule

Win.Trojan.Mansabo-9787658-0
Create hunting rule

Win.Trojan.Mansabo-9787665-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the system32 directory
Creating a process from a recently created file
Creating a window
Result
Verdict:
MALICIOUS
Details
Base64 Encoded Powershell Directives
Detected one or more base64 encoded Powershell directives.
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9504b3b1cf0c21196ec76fc281c2fbc82a183fedfa49c203fa9f2b5d4477a255/
Gathering data
Verdict:
malicious
Similar samples:
174f9c83762b54312988e24bf9292dfd0fd44b62ce8b86463af269059379e746
1d7d407373486969a62a5065b100778cf372553887d5b86277994cb927883317
1e91acd014a0dcf929f9beb50120526bcf3511c014afe065f9f6a3d79907e536
1f39a2d168cf2fe25fddc7ff3026e356f1f81cc8bdf11d57051b991fe8985b2c
2c9df010eb7c37323ed6b2ee6e23078e80055ce35da1ac9c0bf4ea7d2bd5a334
5f65d54f0742f88bf599dad175a5f5674e64dd76a3e8ce06f68b0e83574f2fa3
68dc7c7dfdac09078ca6c904bedaa8975a5c1f06390dfdffffed453d75474014
94bec5f8e96b79d88f1d6d2865f032e44b61bff04aa3ba97c149604695ecb058
aae534ab518c0dfb1c4bc1210fb6cc0c6cb21dcb144fafba18e4fef47bd0f710
beeac63084be78c60a9ea959a979b2c6fd8ce40483fd9b737c49c82f390ccf45
+ 104 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201108-dhs3c2g62a/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments