MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a9c8e2cb8a390858a638a20dbe767db26c4590e8f9d05ba2f1ba747de746522. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a9c8e2cb8a390858a638a20dbe767db26c4590e8f9d05ba2f1ba747de746522
SHA3-384 hash: ba0e8b6a81e72209b4cf84c1a8f8bd79e70ebcf406811e74826b02d0ce782a03c0e3a4c0bd5008adeac20fde728a5661
SHA1 hash: 27f39ef0caf60721d9cdcb6ef3d51724ad40aa52
MD5 hash: ea8a59c0989b8aa915eadd627716f32d
humanhash: oxygen-seventeen-blue-echo
File name:download.dat.dll
Download: download sample
File size:609'792 bytes
First seen:2022-03-25 14:04:51 UTC
Last seen:2022-03-25 15:34:04 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 12288:LExZyofuI3RrP97fRtK9/iNjA5v3gE9dn1:gDfuIBrJptK9/i2oSd1
Threatray 2'294 similar samples on MalwareBazaar
TLSH T141D49C05A795D906C7AC5B7780D6402183FC9857D5AEFB8B2AA825F81E433F4E9083DF
Reporter James_inthe_box
Tags:dll

Intelligence

File Origin
# of uploads :
2
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/257715/
Detection(s):
SecuriteInfo.com.Heur.Variadic.A.466.1.12990.18245.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/623dcc161f204239482996a9/reports/d5508fd3-d912-4db5-86ce-100ece285132/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/99e3fa1e-e6a5-436c-bdf9-a6310d9de4d4
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/964612
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Machine Learning detection for sample
Sigma detected: Execute DLL with spoofed extension
Sigma detected: Suspicious Call by Ordinal
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a9c8e2cb8a390858a638a20dbe767db26c4590e8f9d05ba2f1ba747de746522/
Threat name:
Win32.Trojan.RealProtectPENGSD
Create hunting rule
Status:
Malicious
First seen:
2022-03-25 14:04:01 UTC
File Type:
PE (.Net Dll)
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0603c2488dc90b966ad00a7917e99b3bcc632f3830dc6417dc1b5caf7612e5c1
0cf5c56abe0bfddd98d9bd5ad976e99caaa170e02ca43902773c4d4c7f47bc69
43cb3ca80aa1ca82132bfede80febbf74cb511ae3a683a4f0e26ff8a11b87367
49c7ce5e90b5bce33ac0ea6f02d309e030e81462e290e83403048822e52b1500
4bafcfded2a23cae4a88071893eedbaea9e47031cdfe8ef0c2b97fa55de6feb3
4d1bc3b0096832b12fac401d7c92e3e50d4a1a328435ef2463b2cb0138feb6a5
854bd9747a0ee5f5f619a64be5c94383caa20d465d51a01a784418a30ed6cdc4
ac5593f6eda0771d560c4dc764d2381144c7ea5e1c61d11af6e075a4795478d4
b4327ec29af05b6401734e517cbda55f833c8ed8afc4e232178b470a1ed12aa5
+ 2'284 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220325-rdwq5adfgj/
Unpacked files
SH256 hash:
9a9c8e2cb8a390858a638a20dbe767db26c4590e8f9d05ba2f1ba747de746522
MD5 hash:
ea8a59c0989b8aa915eadd627716f32d
SHA1 hash:
27f39ef0caf60721d9cdcb6ef3d51724ad40aa52
Link:
https://www.unpac.me/results/5aee4471-7fd7-4a80-a206-be2c5f602356/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9a9c8e2cb8a390858a638a20dbe767db26c4590e8f9d05ba2f1ba747de746522

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/257715/

Comments