MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash: 9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d
SHA3-384 hash: b196ee8c42f855abe96f132704cfc13e8cf78adcdc0fc08964de25238a9968dae60e37342a6c535633852ee965fbcecc
SHA1 hash: 82d29b52e35e7938e7ee610c04ea9daaf5e08e90
MD5 hash: e61518ae9454a563b8f842286bbdb87b
humanhash: whiskey-yellow-michigan-indigo
File name:Frkmlkdkdubkznbkmcf.dll
Download: download sample
Signature n/a
File size:280'064 bytes
First seen:2022-01-17 01:28:12 UTC
Last seen:2022-01-17 07:02:32 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (58 x CobaltStrike, 57 x YellowCockatoo, 8 x SUNBURST)
ssdeep 6144:i9JxgDyGljt5zFSb4rKWFV1y3QXJgGsHYjohn/wkKLwZl8UYrOqvM:irxgDyGljt5zF9xS2j8Km4kYM
Threatray 149 similar samples on MalwareBazaar
TLSH T148546BF017D83666D7ED06BED09146C94EE3D05A520FEF95B89AB4E82F03396E902533
Reporter @Jirehlov
Tags:dll WhisperGate

Intelligence


File Origin
# of uploads :
3
# of downloads :
189
Origin country :
US US
Mail intelligence
No data
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed unknown
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Behaviour
Behavior Graph:
Gathering data
Threat name:
ByteCode-MSIL.Trojan.WhisperGate
Status:
Malicious
First seen:
2022-01-16 21:43:52 UTC
File Type:
PE (.Net Dll)
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Behaviour
Checks processor information in registry
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d
MD5 hash:
e61518ae9454a563b8f842286bbdb87b
SHA1 hash:
82d29b52e35e7938e7ee610c04ea9daaf5e08e90

YARA Signatures


MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:extracted_at_0x44b
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments