MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac3db13e7b17b4724d503aac7b9f4d27a9dfa9d48b069aef32ee5e393c5a544e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TA505


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac3db13e7b17b4724d503aac7b9f4d27a9dfa9d48b069aef32ee5e393c5a544e
SHA3-384 hash: b84eac1e6fbae0aadbaa5e3fae61f81a8a1603de1425aec0366cc7a6a9cf1b92206eafe66386f6b8f4f280a3507c3d43
SHA1 hash: 596f74b47eb167a321787ad35d1fd9ca361d2e26
MD5 hash: b27b040dec41bb9cb1df456a7949ee5b
humanhash: purple-angel-whiskey-sink
File name:out_payload_RD86.bin
Download: download sample
Signature TA505
Create hunting rule
File size:512'000 bytes
First seen:2020-09-09 14:22:25 UTC
Last seen:2020-09-09 14:45:09 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 6daa51aec79e9efe13cc189911ea997a (1 x TA505)
ssdeep 12288:cWFZarW64D+3g30ZTWWySIqRxUlG55CNPcAvInfkoAOyW0AV:cPsKTwSIYiNVvIco7yWD
Threatray 3 similar samples on MalwareBazaar
TLSH B0B4F27902E39122C0E95DB450CD0C217C22ED65D75D0B44D7A38AB79E7A2BE35BA2F3
Reporter tbarabosch
Tags:SDBBot TA505


Avatar
tbarabosch
Get2 campaign 2020-09-09

Intelligence

File Origin
# of uploads :
2
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/58191/
Detection(s):
SecuriteInfo.com.Generic.mg.b27b040dec41bb9c.20322.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/462072
Signature
A
b
c
d
e
f
i
l
M
n
o
r
S
t
u
V
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac3db13e7b17b4724d503aac7b9f4d27a9dfa9d48b069aef32ee5e393c5a544e/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-09 14:24:06 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vq63cpt3c62hetkqhkwhxh2ne6u57kourmdjv3zs5zpdspc2krha._file
Verdict:
malicious
Similar samples:
450b38b821f51f8f5726d5be617b4105563038b9e367cb312197a1a56a895a53
TA505
4f3129e7343d1dee0695d18f265f88610ec1c04132be5d1888993278daf8920e
TA505
bc56a888670e5f283189a902abbc9f57a808a66b2938fde1480509c2cb265841
TA505
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/200909-hqdfaj28qa/
Behaviour
Suspicious use of WriteProcessMemory
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Drops file in System32 directory
Sets file execution options in registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.29
Link:
https://yomi.yoroi.company/submissions/ac3db13e7b17b4724d503aac7b9f4d27a9dfa9d48b069aef32ee5e393c5a544e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ReflectiveLoader
Create hunting rule
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TA505

DLL dll ac3db13e7b17b4724d503aac7b9f4d27a9dfa9d48b069aef32ee5e393c5a544e

(this sample)

  
Dropped by
Get2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/58191/

Comments