MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a761168b889a5c5ff56defeb1cedb786ffa90e3b61b6660cfc41e49b1ee638f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.ExtenBro


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a761168b889a5c5ff56defeb1cedb786ffa90e3b61b6660cfc41e49b1ee638f0
SHA3-384 hash: ffcbb7cbe78ddb6bf9da24a185f5d0fe77798c485690cbba7f00d52844b69bab0b4d7bc0283d922c738a269e38407341
SHA1 hash: 8d4d65fe654a2e298bc85546cdee14eb643e0c9d
MD5 hash: a41bfd6d05120229175386d218665093
humanhash: florida-helium-thirteen-west
File name:SecuriteInfo.com.Trojan.Siggen10.27004.14092.32007
Download: download sample
Signature Adware.ExtenBro
Create hunting rule
File size:5'820'416 bytes
First seen:2020-10-02 23:37:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bf1fe1c801107e692a1b8519c836a405 (1 x Adware.ExtenBro)
ssdeep 98304:1FUtvSFhYwJxv7xhbtWKYf7yowSgqvfmdSprbTC52dx+Mdwjy4lLiSPJy4HA3oro:XqvQ/7xdtvtoJ/3merbTacAMGjZi6vFE
TLSH 8046233359711204E0F4CC7D9623BEF632F71B568B81A83969EBBDC72935994E213A43
Reporter SecuriteInfoCom
Tags:Adware.ExtenBro

Intelligence

File Origin
# of uploads :
1
# of downloads :
188
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/67822/
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.27004.14092.32007.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
DNS request
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending an HTTP POST request
Launching a process
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Moving a file to the %temp% directory
Replacing files
Creating a service
Launching a service
Loading a system driver
Enabling autorun
Creating a file in the Windows subdirectories
Deleting a recently created file
Creating a file
Running batch commands
Creating a process with a hidden window
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Launching the default Windows debugger (dwwin.exe)
Enabling autorun for a service
Enabling autorun with the shell\open\command registry branches
Unauthorized injection to a recently created process
Searching for the window
Enabling autorun by creating a file
Sending an HTTP GET request to an infection source
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/480663
Signature
Detected VMProtect packer
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect debuggers by setting the trap flag for special instructions
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a761168b889a5c5ff56defeb1cedb786ffa90e3b61b6660cfc41e49b1ee638f0/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-09-13 03:59:00 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u5qrnc4itjof75ln57vrz3nxq372sdr3mg3gmdh4ihsjwhxghdya._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  10/10
Tags:
upx persistence discovery evasion trojan bootkit
Link:
https://tria.ge/reports/201002-qmlcqe4ed2/
Behaviour
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Runs .reg file with regedit
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Modifies service
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks installed software on the system
Checks whether UAC is enabled
JavaScript code in executable
Writes to the Master Boot Record (MBR)
Deletes itself
Loads dropped DLL
Executes dropped EXE
Looks for VMWare Tools registry key
Sets DLL path for service in the registry
Sets service image path in registry
UPX packed file
Enumerates VirtualBox registry keys
Looks for VirtualBox Guest Additions in registry
ServiceHost packer
Modifies system executable filetype association
Registers COM server for autorun
Unpacked files
SH256 hash:
a761168b889a5c5ff56defeb1cedb786ffa90e3b61b6660cfc41e49b1ee638f0
MD5 hash:
a41bfd6d05120229175386d218665093
SHA1 hash:
8d4d65fe654a2e298bc85546cdee14eb643e0c9d
Link:
https://www.unpac.me/results/8ddc0622-ae31-4a8f-b506-4811ac1fee0b/
SH256 hash:
530d4cfa68132a007e620c553f3ba02f65ddd6983ff65e62a6ed4bbce8521c83
MD5 hash:
84884b22b9d4cfc52ce09b504edba733
SHA1 hash:
4c5f1a0b19b07a5904325b94c730293160e28bf1
Link:
https://www.unpac.me/results/8ddc0622-ae31-4a8f-b506-4811ac1fee0b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Strictor
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/a761168b889a5c5ff56defeb1cedb786ffa90e3b61b6660cfc41e49b1ee638f0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Datper
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Datper in memory
Reference:https://blogs.jpcert.or.jp/en/2017/08/detecting-datper-malware-from-proxy-logs.html
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/67822/

Comments