MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b820101221c735fdab1decf617d4a8c6bedba759d0821972f71eb2abd8fe1e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b820101221c735fdab1decf617d4a8c6bedba759d0821972f71eb2abd8fe1e7
SHA3-384 hash: 1a8afa6262e7d80e3faabc2f9c8bf82690f3abb2eb543166b1bf446cfefad5dcc0c312e2e4a862d8ab85d77653590d47
SHA1 hash: 1e220b27f4ad5e2e97ea43ac4bac804bf2dae1ca
MD5 hash: 8f99a5b1049ba903ef2e9b5e6818f2d8
humanhash: asparagus-nuts-jig-papa
File name:9b820101221c735fdab1decf617d4a8c6bedba759d0821972f71eb2abd8fe1e7
Download: download sample
File size:303'938 bytes
First seen:2020-09-04 07:29:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f7f39dbdecdc6b336bd0d4dea4777041
ssdeep 6144:hK/KKzOl7vSd0MW1+Va522wykwCuNSOmxQ1ZT23iifNP:YCJZSaXMEE2fSxFeTqiQl
TLSH 8D5419A4F686FEF5FC459B7914F1131D539EA291EB2CE7337850FE28010AA5881B364E
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/55577/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/459965
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b820101221c735fdab1decf617d4a8c6bedba759d0821972f71eb2abd8fe1e7/
Threat name:
Win32.Trojan.Rozena
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 14:04:25 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/200904-pced8edrdx/
Behaviour
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9b820101221c735fdab1decf617d4a8c6bedba759d0821972f71eb2abd8fe1e7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/malwrhunterteam/status/1296005107637719040?s=20
Cape
Cape
https://www.capesandbox.com/analysis/55577/

Comments