MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92
SHA3-384 hash: 1cae12a5c55df0df5298d4f279904819c22069efce205bfed2caea5f509420982ca20c701616eb18ff3e509b72702179
SHA1 hash: 189166d382c73c242ba45889d57980548d4ba37e
MD5 hash: 5d5c99a08a7d927346ca2dafa7973fc1
humanhash: beryllium-helium-carolina-batman
File name:stage1.exe
Download: download sample
File size:27'648 bytes
First seen:2022-01-16 23:23:49 UTC
Last seen:2022-06-19 14:33:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3a2a2de20daa74d8f6921230416ed4e6
ssdeep 384:hgvApUHEZKu08YtQI4GS1dxRBUHCHCHCHCHCHCHCHCHCHCHCHCHCHCHCHfskp2BD:ivmUHEZ4yVUiiiiiiiiiiiiiii9pd
Threatray 96 similar samples on MalwareBazaar
TLSH T192C22A89F2494DE9F062C7B514DB9FB2EE62992244116BA3CB2DE3BCCE3B3415D13521
Reporter Anonymous
Tags:DEV-0586 exe WhisperGate Wiper


Avatar
Anonymous
stage1 sample from the following publication:

"Destructive malware targeting Ukrainian organizations", by
Microsoft Threat Intelligence Center (MSTIC)
Microsoft Digital Security Unit (DSU)
Microsoft 365 Defender Threat Intelligence Team
Detection and Response Team (DART)

Intelligence

File Origin
# of uploads :
6
# of downloads :
695
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92
Verdict:
No threats detected
Analysis date:
2022-01-16 21:42:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1b906967-67a7-40e4-9916-cf380df24152

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/219661/
Detection(s):
SecuriteInfo.com.Win32.KillMBR.NGI.4820.14173.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Rewriting of the hard drive's master boot record
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/4393/overview
Behaviour
MalwareBazaar
CPUID_Instruction
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug diskwriter
Link:
https://www.filescan.io/uploads/61e4a9151883c5ba4ed59279/reports/102f1521-dbd3-49a6-bb23-2c00a0e34f0c/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/88a69434-9ce5-44ac-9374-6625f3600b4c
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/921496
Signature
Contains functionality to access PhysicalDrive, possible boot sector overwrite
Contains functionality to infect the boot sector
Infects the VBR (Volume Boot Record) of the hard disk
Multi AV Scanner detection for submitted file
Writes directly to the primary disk partition (DR0)
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Trojan.WhisperGate
Create hunting rule
Status:
Malicious
First seen:
2022-01-16 15:18:35 UTC
File Type:
PE (Exe)
AV detection:
32 of 43 (74.42%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
08e34fc9a01f4fd9017b61612d5eac56f1a28945c48d40908da62e430ac9a7d0
0c7aaf3999899c4f29ea325f11746ab98462151fa78a15b8ca505973ac71fd02
10a5bbeeb39216bde492a246b1b003bcb2d7c0895dea287b5f8ad4f3428ef3cc
3b17e1d94b70f6d8fc6b56071259a9affacc235a92d7a772b27ddd0c01783d4a
4a0f52dab31cc96ebe813dfce03401b5813d10153ffd805ba61b06cb169eee6a
b425fcfcab98d57a198166faa21768b84e6ab8c75d3864375eed40ca4162fdc0
b50fb20396458aec55216cc9f5212162b3459bc769a38e050d4d8c22649888ae
be97f2438f11faa0b836f9e01570d20e1e21c981c858a6bc8e144d6ced8c4157
+ 86 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
bootkit persistence
Link:
https://tria.ge/reports/220116-3dnw3agefr/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Writes to the Master Boot Record (MBR)
Unpacked files
SH256 hash:
a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92
MD5 hash:
5d5c99a08a7d927346ca2dafa7973fc1
SHA1 hash:
189166d382c73c242ba45889d57980548d4ba37e
Link:
https://www.unpac.me/results/7e79a8c4-a89c-462a-964d-120fc962bf12/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a196c6b8ffcb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
  
Link
https://tria.ge/220116-28g7bsgcf6
  
Link
https://samples.vx-underground.org/APTs/2022/2022.01.15/Samples/
  
Dropping
WhisperGate
  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/219661/

Comments