🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c906c2f3bfb24883a8784a92515e6337e1767314816d5d9738f9ec182beaf44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Lazarus


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c906c2f3bfb24883a8784a92515e6337e1767314816d5d9738f9ec182beaf44
SHA3-384 hash: a41207b5e4a3b879a6c999806605292552d76e2dee39ee6c3f8442111d9c39ec134d938aa7eae047f8c37e74b86859e8
SHA1 hash: ea93acf0c278dd59e29ae1402d35db8e0f3ae966
MD5 hash: 8ed89d14dee005ea59634aade15dba97
humanhash: cat-lake-july-lactose
File name:GDLS_2020090392828334.doc
Download: download sample
Signature Lazarus
Create hunting rule
File size:533'504 bytes
First seen:2020-09-08 06:27:58 UTC
Last seen:2021-04-27 22:50:53 UTC
File type:Word file doc
MIME type:application/msword
ssdeep 6144:VpFD8N8qpxXvztgWWghMqnuyfqxKmT49oCir3k:VpFDNqLvzfhMqvycI4
TLSH 68B47D8DE1673892F8B81FF4AC9C3687DA384F3B0955002972E6394C9B7B5F9814E653
Reporter Anonymous
Tags:doc Lazarus

Intelligence

File Origin
# of uploads :
3
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
MiscreantPunch.SingleXOR.EXE.HEX.163.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.MacroStartMenuMeUp.20200120.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Moving a file to the %temp% directory
Creating a file
Creating a process with a hidden window
Launching a process
DNS request
Sending a custom TCP request
Enabling autorun by creating a file
Running batch commands by exploiting the app vulnerability
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9c906c2f3bfb24883a8784a92515e6337e1767314816d5d9738f9ec182beaf44/
Threat name:
Script-Macro.Trojan.EmoooDldr
Create hunting rule
Status:
Malicious
First seen:
2020-09-08 02:48:25 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro
Link:
https://tria.ge/reports/200908-84fawnybke/
Behaviour
Office macro that triggers on suspicious action
Suspicious Office macro
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Virus
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9c906c2f3bfb24883a8784a92515e6337e1767314816d5d9738f9ec182beaf44

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/RedDrip7/status/1303186209158492160

Comments