MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0fb861b99623e2d2a3c3f932142bfa0181562249abbae46fa2f3c2fa20376c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Hive


Vendor detections: 9


Intelligence 9 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a0fb861b99623e2d2a3c3f932142bfa0181562249abbae46fa2f3c2fa20376c2
SHA3-384 hash: 4c89e35b49387b3a6dcc4a0f53fe0c0c5cf4df56b52ba963a7bc756f3a0e2ea01faf4bfb67dc33e466c5ccea0724dc8a
SHA1 hash: d3b53146d0d8c1998d75d241c5e49ce85b298852
MD5 hash: f3777fa148322ccafcc0c0e1da3deb30
humanhash: cup-single-mango-stairway
File name:SecuriteInfo.com.Variant.Ransom.Hive.1.2907.23837
Download: download sample
Signature Hive
Create hunting rule
File size:387'584 bytes
First seen:2022-08-24 19:31:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6ed4f5f04d62b18d96b26d6db7c18840 (254 x SalatStealer, 78 x BitRAT, 42 x RedLineStealer)
ssdeep 6144:VWZCzZPxGM3sowGfkRmO2iIC/82iq+cXAoX+/gBciDboSm0er4HfojJML2ypQG7Q:VzGM36AiJk2x+e+OcinoSm0W4/ojJq2X
TLSH T12E8423921D098805FE3D4C3C0C515D869DE9A3E7E0F6C06BABDE1339F82A95C194A72F
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4505/5/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
Reporter SecuriteInfoCom
Tags:exe Hive

Intelligence

File Origin
# of uploads :
1
# of downloads :
456
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.Ransom.Hive.1.2907.23837
Verdict:
Suspicious activity
Analysis date:
2022-08-24 19:33:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d12291ef-6360-4e6c-a3ce-28fec24bc188

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/300961/
Detection(s):
SecuriteInfo.com.Variant.Ransom.Hive.1.2907.23837.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed virus wacatac
Link:
https://www.filescan.io/uploads/63067d31b6f2a6ec1d620a13/reports/007be1ba-3f82-4101-8ade-7cfadebabb39/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Stowaway
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/66cabb06-c62c-49a1-a685-571d5788ce4a
Result
Threat name:
MicroClip
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1057263
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected MicroClip
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a0fb861b99623e2d2a3c3f932142bfa0181562249abbae46fa2f3c2fa20376c2/
Threat name:
Win32.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2022-08-24 16:46:01 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ud5ymg4zmi7c2kr4h6jscqv7uambkyretk524rx2f46c7iqdo3ba._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/220824-x8xvkaabcl/
Behaviour
UPX packed file
Unpacked files
SH256 hash:
7ca19972b77507ab4f2bb8466d8405b9dacead26232bae4c41951ecc9024c44f
MD5 hash:
8331434eaa21a9f86d603e354e57fcef
SHA1 hash:
6f87d6eb8333cb6cb2343549b52a17a5a7325136
Link:
https://www.unpac.me/results/59ecf1c4-88ff-4921-b0a3-c57fff32f6b5/
SH256 hash:
a0fb861b99623e2d2a3c3f932142bfa0181562249abbae46fa2f3c2fa20376c2
MD5 hash:
f3777fa148322ccafcc0c0e1da3deb30
SHA1 hash:
d3b53146d0d8c1998d75d241c5e49ce85b298852
Link:
https://www.unpac.me/results/59ecf1c4-88ff-4921-b0a3-c57fff32f6b5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/a0fb861b99623e2d2a3c3f932142bfa0181562249abbae46fa2f3c2fa20376c2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:methodology_golang_build_strings
Create hunting rule
Author:smiller
Description:Looks for PEs with a Golang build ID

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Hive

Executable exe a0fb861b99623e2d2a3c3f932142bfa0181562249abbae46fa2f3c2fa20376c2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2276491/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/300961/

Comments