MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95859fa42a069a3b87fc3040b5154311abe0ee9052fdff9d902869f8b08af974. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DiskWriter


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95859fa42a069a3b87fc3040b5154311abe0ee9052fdff9d902869f8b08af974
SHA3-384 hash: 7058d8472a0293c1ce69d2ae1a40197510c59ff0e29cef506225a48687982b4bd230aff1ecee5b56e7d15640cdf177c2
SHA1 hash: acedc389d7e64ba6f5d82a7bfe2f7486a0453316
MD5 hash: c1edd4f5f08c58c60923e33d9266b60f
humanhash: oranges-wolfram-wisconsin-north
File name:C1EDD4F5F08C58C60923E33D9266B60F.exe
Download: download sample
Signature DiskWriter
Create hunting rule
File size:646'144 bytes
First seen:2022-06-19 14:35:18 UTC
Last seen:2022-06-19 15:47:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c5df5f515f76bb815fad87fade1c304d (7 x RedLineStealer, 3 x Smoke Loader, 1 x DiskWriter)
ssdeep 12288:OaaXMQJNUrVF4M+RShdLSkaPNuhWQZrXQbhs2i+OqJ5W2lcKd6E:JaVoxFp/hMPQhWqrXQbhs2i+O05W2ljl
Threatray 68 similar samples on MalwareBazaar
TLSH T16CD4E110B7A0E034F5B702F549B5C368A92D7DA1AB28C1CB5AD5FAEE5A346D1EC30347
TrID 39.4% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
29.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 9824e790c4e72158 (31 x RedLineStealer, 18 x Smoke Loader, 16 x ArkeiStealer)
Reporter obfusor
Tags:DiskWriter exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
305
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MBR killer.zip
Verdict:
Malicious activity
Analysis date:
2022-05-28 07:59:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ca623875-fb97-4add-ba25-f02c1cf00bf8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/281304/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.33054.20813.7082.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Rewriting of the hard drive's master boot record
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/21973/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/62af34946ca90a5b22cbaf39/reports/d145e080-3bd1-4ed2-ac3f-7c79cf73c776/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Pitou
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/630df4c2-7e34-4f1c-be3d-6ccb34e2c436
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1015926
Signature
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/95859fa42a069a3b87fc3040b5154311abe0ee9052fdff9d902869f8b08af974/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-05-28 06:14:24 UTC
File Type:
PE (Exe)
Extracted files:
31
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=swcz7jbka2ndxb74gbalkfkdcgv6b3uqkl677hmqfbu7rmek7f2a._file
Verdict:
malicious
Similar samples:
05276ad049558f6784fde853165a2e6de3c1a431dbf440c999108aa5e72c9c1e
DiskWriter
2d1ce8037528ca32f3155729c0096ee9508a2df376f465a027a6c6dfba29bbd3
DiskWriter
7488777dd491486b1aea7ec37b6131334f94bc3f90261d91f06a5156f0530232
DiskWriter
770f8cd0cae0a7525234dfc5b25f21b90090513d3f80fa06e8c22107ca8bbe01
DiskWriter
7b6f16085681fe8c39af2c9c2c2b4bfb8374660e7c5f5a840c503b0d05afe6fe
DiskWriter
7bf8c9d0aecc3f364134783278f951da9017e5c7be35073f744ded5035bef142
DiskWriter
7e95736b12f455cd096c0eff4a9dfa5b4e3c8108c55464447868ba4351e91fbb
DiskWriter
cab31c58eec5fac87df0c7cf52df12ab43280e4e8b9ee50fcde4017689c976b3
DiskWriter
cf693fb0c08e8e23de98bb5b848e6ee6f359f1efb26d1488bb9030c899d45005
DiskWriter
e74a586b8f1c0b606cde2a079a333ce8f93a3ccf133b049d2de243e52989a275
DiskWriter
+ 58 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
bootkit persistence
Link:
https://tria.ge/reports/220619-ryj8tsehbp/
Behaviour
Writes to the Master Boot Record (MBR)
Unpacked files
SH256 hash:
87f776743f1852705d418c3627744380019e9d63dd70737962f56bd2f1ff107a
MD5 hash:
beb1f632da458d8cdd00103654be92c9
SHA1 hash:
3cd539f2cb3a2f2cfbc1943a32432bfbc7f81b96
Link:
https://www.unpac.me/results/2f9095eb-fd88-48e8-8d8b-333178edd50a/
SH256 hash:
95859fa42a069a3b87fc3040b5154311abe0ee9052fdff9d902869f8b08af974
MD5 hash:
c1edd4f5f08c58c60923e33d9266b60f
SHA1 hash:
acedc389d7e64ba6f5d82a7bfe2f7486a0453316
Link:
https://www.unpac.me/results/2f9095eb-fd88-48e8-8d8b-333178edd50a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/95859fa42a06/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/95859fa42a069a3b87fc3040b5154311abe0ee9052fdff9d902869f8b08af974

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DiskWriter

Executable exe 95859fa42a069a3b87fc3040b5154311abe0ee9052fdff9d902869f8b08af974

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2211342/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/281304/

Comments