MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab5290082addf7d5c9151647adfd31428c713aafa76f9e8bcb5aa609abd3dbef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab5290082addf7d5c9151647adfd31428c713aafa76f9e8bcb5aa609abd3dbef
SHA3-384 hash: bbe317de227c7698d4801aa5348aaf3d254bcfadcc3f203360aabe15b60065cf3811aabb533294730a7a85fbfb99c2f1
SHA1 hash: cc6a2e742aade15a0c8677492e9f7036b2bb862f
MD5 hash: 79321dc10d8c2533e10dfef37d2266c3
humanhash: purple-pennsylvania-quebec-king
File name:ab5290082addf7d5c9151647adfd31428c713aafa76f9e8bcb5aa609abd3dbef
Download: download sample
File size:400'384 bytes
First seen:2020-06-16 09:34:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5688b19b58c75a0462a77240ace49a5e (3 x njrat, 1 x CryptoDarkRubix)
ssdeep 12288:8I5rnHt+Sr5WY5LFiTWmAfVW/1AqhTwtj7ba:8EN+Sr5hYWmAfVo1D0tj7ba
Threatray 42 similar samples on MalwareBazaar
TLSH E584C035E5C0483BE2771F7C9D2691955C2DBE102D382C46BBFD0D0CABBA6462A39397
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Xtreme
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10757/
Detection(s):
PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Win.Trojan.Delf-2345
Create hunting rule

Win.Trojan.Xtreme-5744908-0
Create hunting rule

Gathering data
Threat name:
Win32.Backdoor.XtremeRAT
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 14:08:00 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
28006c46a4b5be075add55f0c3d152f0d222f6af26b69e8d1295bc1be363c4df
70d86fc8d1247dcd26ed0927411614973d45216d676978f768e14cb16d362536
70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21
991c4166a2246ca5ae9186a1e747f5eb767fdbd304dbfa1c5f4a2019cb6b4aec
9b281a8220a6098fefe1abd6de4fc126fddfa4f08ed1b90d15c9e0514d77e166
9e6c0d4f163023b3f001d49cf313e8cce5e03cab40685d4f5f6212696f05f470
aeb1bfcef382789091e72e2d6cae6e471123d0e8e7a5f39c64abf5a3d9a4eaa8
af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a
db8d3e1f805b2f6219f99004258e23b3dd379a2dcc76338e3fb368ad23112a3b
e3bb8c334350185803b3863f71d6fced186b373e8768bb537e371dff11f74386
+ 32 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/200624-wkwfpg9qea/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Drops file in Windows directory
Adds Run entry to start application
Deletes itself
Modifies Installed Components in the registry
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10757/

Comments