MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a59145613a5c1d6e1adee5e919b955459668b0b00c330863e4edc4fbcd28d41c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a59145613a5c1d6e1adee5e919b955459668b0b00c330863e4edc4fbcd28d41c
SHA3-384 hash: 3daa749dbaab8d3055543c8f99116a36e7a1887a8d9134a5bac7e09daae0af78a76a479592d60fc0b23fcf7484a18403
SHA1 hash: 36cf795cbb5bbb55101f53d9f0bdd677f74e42f0
MD5 hash: 3404dac60e82c1126ac6077736a17c43
humanhash: angel-leopard-oxygen-bulldog
File name:a59145613a5c1d6e1adee5e919b955459668b0b00c330863e4edc4fbcd28d41c
Download: download sample
File size:175'616 bytes
First seen:2020-06-10 11:30:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 29c4c5f8766667965cf6248336ce2ba0 (13 x Shifu)
ssdeep 3072:Z6pQc+sSxnTrGadgsFqZeo4pwkhUmZr3hPsOraS87FYqjTZbn4TGz:Z6p2sSxTrGvsFUejWyZr3hPswa1TZjxz
Threatray 325 similar samples on MalwareBazaar
TLSH 63041217A5E313D2C0AA0BF904F39235D2D16678A3D4C790C3D272367E22BBB1A3B655
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Mpress-7
Create hunting rule

Win.Trojan.Shifu-6330434-1
Create hunting rule

Win.Malware.Shifu-6804440-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Shifu
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 15:43:26 UTC
File Type:
PE (Exe)
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0f07aa88ec8e1a55917bb90f913f72a9f94ea9e563ccab7320005b6b50c6d97b
21fd0a00b8db32db7e34c7dcb90be5de4f6e647fb49e0258c0914639c1e737fd
33d7de7f97494b6669001a55e883b2f091cec2a5dde5c8e57720a471538b66a7
41055ab5cb8446eb4942e696a1cfe10c466b3a096cbd0438fb315811f0d50083
90b9ef459627fd194fa517704030952bfa130eced80e4e576289513b63a18904
925078de5cac6381da4329e372dded93535405fa708bd36f8a1dbd997521d825
b41d2887882663ad86d612d600b3efaf7d68cbf6b5b085076afa8ce4204a6f2e
b90ced224b86de8dbf45ee83f248216a253141d503d64582cab31f982ce8ac57
dd5f5163b0cc50c3c60ba5035d21e15cf93fa017c7fd2f8f6e04de22689299e0
f1de1559dd1e239eaa50ce46f7594d932c7909ec7816ca15ab58fae0a258ab48
+ 315 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-rpak8nlnmj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments