MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac80582931ac0fbe465b81a7f53894d9eebf867cae0c9e2865136078826bb49a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac80582931ac0fbe465b81a7f53894d9eebf867cae0c9e2865136078826bb49a
SHA3-384 hash: 3349f7a6b46cb8e2abc34eab266441e9e9eb08fa2cb3be087071ee704ba8f559ed2ac6a9abc4ec33b508f3fddf1fc581
SHA1 hash: 19e09711a18c9c027f1bd95d33746e0fe2ebda67
MD5 hash: a1eccd2ad938cef4b26e5606542ba44f
humanhash: kilo-robin-salami-oven
File name:a1eccd2ad938cef4b26e5606542ba44f.exe
Download: download sample
File size:2'847'617 bytes
First seen:2022-03-22 19:02:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b78ecf47c0a3e24a6f4af114e2d1f5de (295 x GuLoader, 23 x Formbook, 21 x RemcosRAT)
ssdeep 49152:ev3PqgUs7HnHNS/DIpaxTLKtNuc0GT8GxQ3yg0ALDCOlFinsPPE4cVCPpqP9e:U3BUs7nNe+YGtsc08bG3gA3lgmMdVCPh
Threatray 2'628 similar samples on MalwareBazaar
TLSH T1EBD53330BEA0CF47F11732B645E6FEF23328FA19A78346476A412F929E6A8770C1550D
File icon (PE):PE icon
dhash icon 69ccd4d49696cc71 (13 x Adware.Adload, 8 x CoinMiner, 7 x ValleyRAT)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/255120/
Detection(s):
SecuriteInfo.com.BackDoor.Siggen2.2488.26461.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/10497/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/623a1d820cd58dbd92d8c28b/reports/8a2fd7d0-1740-464c-80ea-75cd5fe20e76/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/19b0a871-0e09-43c9-9117-70eaf9b490e4
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/962034
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac80582931ac0fbe465b81a7f53894d9eebf867cae0c9e2865136078826bb49a/
Threat name:
Win32.Trojan.FlawedAmmyy
Create hunting rule
Status:
Malicious
First seen:
2022-03-22 18:56:57 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1273c78b4f196fc982cb1e9b7abe9d2b5c4f10c5486e7a891615bb273fef419d
35e4927ea02978e01bee3917c5c2c92d46308473bf3eaf4ef1d4d3c0eb0a0d4f
3de11e9ba2b8db6be4069506a95bc31250d8ae8d0df5e8fec66121a05f1ccbc6
4f9d6b736fbd00a1b8790ab77d6bde5b573b2177b7606724d2b6406839ceae3d
6997b092bad4debd075be5e71976075f262e0e21f47e34db16ba1985d51d8017
861f5a47b316a7668eedc2c5b7f7780406735223bd41a2a29f5df29331f7e51f
a5c940653c3b19cacd1378f2081feb377f2791257fbef36cd64df3a0b1b7d4b4
b643d5ee1be492fcbfbfb4c9b9bf3da8460b74ab2097b96e6545318c92f2ee26
c787a0aa20d047aec48e31f551fe6511c893f93abd0210a5cfbd95b3b9cc5750
dcb25316bc3b1978f4acb2cce9804787843d832b46939195550ccdfc2f7f947c
+ 2'618 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220322-xqcfxadchl/
Behaviour
Enumerates physical storage devices
Unpacked files
SH256 hash:
ac80582931ac0fbe465b81a7f53894d9eebf867cae0c9e2865136078826bb49a
MD5 hash:
a1eccd2ad938cef4b26e5606542ba44f
SHA1 hash:
19e09711a18c9c027f1bd95d33746e0fe2ebda67
Link:
https://www.unpac.me/results/c42107b8-8eef-42b0-96a7-87768e753926/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.08
Link:
https://yomi.yoroi.company/submissions/ac80582931ac0fbe465b81a7f53894d9eebf867cae0c9e2865136078826bb49a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe ac80582931ac0fbe465b81a7f53894d9eebf867cae0c9e2865136078826bb49a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2109342/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/255120/

Comments