MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Add tag Delete this sample Report a False Positive

SHA256 hash: 9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d
SHA3-384 hash: b196ee8c42f855abe96f132704cfc13e8cf78adcdc0fc08964de25238a9968dae60e37342a6c535633852ee965fbcecc
SHA1 hash: 82d29b52e35e7938e7ee610c04ea9daaf5e08e90
MD5 hash: e61518ae9454a563b8f842286bbdb87b
humanhash: whiskey-yellow-michigan-indigo
File name:Frkmlkdkdubkznbkmcf.dll
Download: download sample
Signature n/a
File size:280'064 bytes
First seen:2022-01-17 01:28:12 UTC
Last seen:2022-01-17 07:02:32 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (58 x CobaltStrike, 57 x YellowCockatoo, 8 x SUNBURST)
ssdeep 6144:i9JxgDyGljt5zFSb4rKWFV1y3QXJgGsHYjohn/wkKLwZl8UYrOqvM:irxgDyGljt5zF9xS2j8Km4kYM
Threatray 149 similar samples on MalwareBazaar
TLSH T148546BF017D83666D7ED06BED09146C94EE3D05A520FEF95B89AB4E82F03396E902533
Reporter @Jirehlov
Tags:dll WhisperGate

Intelligence

File Origin
# of uploads :
3
# of downloads :
189
Origin country :
US US
Mail intelligence
No data
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/219672/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Agentb.4c.19960.29778.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed unknown
Link:
https://www.filescan.io/uploads/61e4c660f81da814af87615d/reports/22e5d9db-eaf1-4831-9fa1-e950ac946955/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1307e0f9-3551-4846-88f3-72a5f974b6f2
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/921511
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
ByteCode-MSIL.Trojan.WhisperGate
Create hunting rule
Status:
Malicious
First seen:
2022-01-16 21:43:52 UTC
File Type:
PE (.Net Dll)
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
02031efb74a10f9a28cb689825268a963ea207e8c74b68aa67e7cfd70e7b174f
30b71db8fd221bb29f1965ced700337d5b90251876a2ad72d38b4d427f3da41d
3837dc32928e8556207e8dafb872968279682dc4a848d09f73823818d2fb7dff
56c502452a4299f2681ef4582adf3d3ebd890b7021e5ed0efc54c30aaea0a1c3
8256c24d02c5a109077b512ce3b45d7f95bf38cc01c33a968bea89f244f48e40
a86e34d719bb89e503654d8820335b0bc9e742c609353915a5634d89876f88d6
b7376049b73feb5bc677a02e4040f2ec7e7302456db9eac35c71072dd95557eb
d43d73de0937150cc384283fe5f3a0899c5c0a9e9461d60cb9f18b193554c26a
f1be4e6d3dc2c6d4ad04a512152177aea74eafcf6c17824db54ef95185915139
+ 139 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220117-bv8t1sgfhk/
Behaviour
Checks processor information in registry
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d
MD5 hash:
e61518ae9454a563b8f842286bbdb87b
SHA1 hash:
82d29b52e35e7938e7ee610c04ea9daaf5e08e90
Link:
https://www.unpac.me/results/b8e24a6a-a3ad-43fd-b0d9-3c2987e70a56/
AV coverage:
19.70%
AV detections:
13 / 66
Link:
https://www.virustotal.com/gui/file/9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d/detection/f-9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d-1642385105
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d

YARA Signatures

MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/219672/

Comments