🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7a86cbf520c0ca37e2f8e37584fcd9c68e79614fd8352d10a7bb223c3a3a39b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7a86cbf520c0ca37e2f8e37584fcd9c68e79614fd8352d10a7bb223c3a3a39b
SHA3-384 hash: 458566390d22a75c7d53ac53f658ed8ad0898f7205a6f041e676089a932e73a54aa8d77f5a9aeec8c19c6efebf1d945b
SHA1 hash: 7af27ee542f599e4b68a032bc43295eec03c1e0e
MD5 hash: ffff18fc7c2166c2a1a3c3d8bbd95ba1
humanhash: crazy-pennsylvania-virginia-red
File name:a7a86cbf520c0ca37e2f8e37584fcd9c68e79614fd8352d10a7bb223c3a3a39b
Download: download sample
File size:431'104 bytes
First seen:2020-09-15 15:04:07 UTC
Last seen:2020-09-15 15:39:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash cf88d77cb1bed2a869c12b0a754c7b92
ssdeep 3072:lZJcY3O6a2iEWp5xINI4OIiwuGgmBZDG3StAjr2kMczzydo/vX9VT:/JcYEPtdINI4OIi3D3StNynyS/fvT
Threatray 1 similar samples on MalwareBazaar
TLSH 519482D2E2AB429DCC5513BD94338D2256A3FC7A8874567B21BCF227DE73389061DD0A
Reporter JAMESWT_WT
Tags:GoldDragon imsuky

Intelligence

File Origin
# of uploads :
3
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/60667/
Detection(s):
SecuriteInfo.com.BackDoor.XeyoRat.2.24191.4973.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Delayed writing of the file
Launching a process
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending an HTTP POST request
Deleting a recently created file
Sending an HTTP GET request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/466810
Signature
Antivirus / Scanner detection for submitted sample
Found C&C like URL pattern
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Writes or reads registry keys via WMI
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 285811 Sample: rF1jWQcACa Startdate: 15/09/2020 Architecture: WINDOWS Score: 84 33 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->33 35 Antivirus / Scanner detection for submitted sample 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 2 other signatures 2->39 7 rF1jWQcACa.exe 1 15 2->7         started        10 OpenWith.exe 2->10         started        process3 dnsIp4 31 foxonline123.atwebpages.com 185.176.43.80, 49695, 49696, 49701 ZETTA-ASBG Bulgaria 7->31 12 cmd.exe 1 7->12         started        14 cmd.exe 1 7->14         started        16 cmd.exe 1 7->16         started        18 cmd.exe 2 7->18         started        process5 process6 20 systeminfo.exe 1 1 12->20         started        23 conhost.exe 12->23         started        25 conhost.exe 14->25         started        27 conhost.exe 16->27         started        29 conhost.exe 18->29         started        signatures7 41 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 20->41 43 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 20->43 45 Writes or reads registry keys via WMI 20->45
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a7a86cbf520c0ca37e2f8e37584fcd9c68e79614fd8352d10a7bb223c3a3a39b/
Threat name:
Win32.Trojan.Kimsuky
Create hunting rule
Status:
Malicious
First seen:
2020-07-24 09:57:08 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
70298c1bfc6b8e07c0600f9264712211bcc7b57b28853d8143f249639cdf6569
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200915-512s5mapde/
Behaviour
Gathers system information
Suspicious use of WriteProcessMemory
Gathers system information
Modifies registry class
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Zbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a7a86cbf520c0ca37e2f8e37584fcd9c68e79614fd8352d10a7bb223c3a3a39b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/60667/

Comments