MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 993afa5ca786935ff44f01d5495e0583034008d30d93eaac100e6d4325dfb89d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | 993afa5ca786935ff44f01d5495e0583034008d30d93eaac100e6d4325dfb89d |
|---|---|
| SHA3-384 hash: | 60675f5f084cfb7f1160c5dbd198a5383c0f2c538ea2e6d478452a5789c7593c2254ef7c0a962fea055bb686d13a85bc |
| SHA1 hash: | a042692fdfb66396b030db8eeb62ed9661c291e0 |
| MD5 hash: | 1ca8921a54b9e0b83898b465bcb825ec |
| humanhash: | uranus-zebra-equal-violet |
| File name: | 1.exe |
| Download: | download sample |
| File size: | 91'648 bytes |
| First seen: | 2022-02-15 16:10:44 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 2c5f2513605e48f2d8ea5440a870cb9e (60 x Babadeda, 6 x AveMariaRAT, 5 x CoinMiner) |
| ssdeep | 1536:L7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfGwJOc:H7DhdC6kzWypvaQ0FxyNTBfGo |
| Threatray | 1'277 similar samples on MalwareBazaar |
| TLSH | T19E936D41F3E202F7E6F2053100A6726F973663389764A8EBC74C2D529913AD5A63D3F9 |
| Reporter |  r3dbU7z |
| Tags: | backdoor exe rdp |
Intelligence
File Origin
# of uploads :
1
# of downloads :
484
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1ca8921a54b9e0b83898b465bcb825ec.exe.vir
Verdict:
Suspicious activity
Analysis date:
2022-02-16 01:47:53 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Running batch commands
Launching a process
Launching a service
Launching the process to change the firewall settings
Loading a system driver
Сreating synchronization primitives
Creating a file in the system32 subdirectories
Searching for synchronization primitives
Creating a file
Launching the process to interact with network services
Creating a file in the Windows subdirectories
Forced system process termination
Searching for the window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Signature
Contains functionality to hide user accounts
Machine Learning detection for sample
Modifies the windows firewall
Multi AV Scanner detection for submitted file
Sigma detected: Active Directory User Backdoors
Sigma detected: Netsh RDP Port Opening
Sigma detected: RDP Sensitive Settings Changed
Uses netsh to modify the Windows network and firewall settings
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2022-02-12 19:43:25 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
21 of 43 (48.84%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 1'267 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
9/10
Tags:
evasion
Behaviour
Runs net.exe
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Modifies Windows Firewall
Grants admin privileges
Unpacked files
SH256 hash:
993afa5ca786935ff44f01d5495e0583034008d30d93eaac100e6d4325dfb89d
MD5 hash:
1ca8921a54b9e0b83898b465bcb825ec
SHA1 hash:
a042692fdfb66396b030db8eeb62ed9661c291e0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 993afa5ca786935ff44f01d5495e0583034008d30d93eaac100e6d4325dfb89d
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.