MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aca598e2c619424077ef8043cb4284729045d296ce95414c83ed70985c892c83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aca598e2c619424077ef8043cb4284729045d296ce95414c83ed70985c892c83
SHA3-384 hash: 51e53f1b8f0874abe97b7c6eeb750978d2c1ce9e67bd17a0c6bbf415368939d0304923ed4a81cdb512a8169a865cdfe1
SHA1 hash: b8fe7884d2dc4983fb0fbca192694ce2f4685e23
MD5 hash: dfd09e91b7f86a984f8687ed6033af9d
humanhash: pennsylvania-ceiling-sink-yankee
File name:aca598e2c619424077ef8043cb4284729045d296ce95414c83ed70985c892c83
Download: download sample
File size:232'960 bytes
First seen:2020-10-02 08:25:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6b8fa355d78d649f199232a25e22d630
ssdeep 3072:XU5r72JE+FYWR0jZLShk4cPT/QzSaQ0sCFneZTznIhZJJcrJ1GHeV9:XU5uJpYnZL05STQNddFnAnGZIrV
Threatray 2 similar samples on MalwareBazaar
TLSH B8345B61B980E476E0D20575A7B98FF78D39A6311B2860D3A3F81EB51FA01D5B63C34B
Reporter JAMESWT_WT
Tags:VIVACIOUSGIFT

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/67670/
Detection(s):
Win.Trojan.Agent-6971031-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/480025
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aca598e2c619424077ef8043cb4284729045d296ce95414c83ed70985c892c83/
Threat name:
Win32.Trojan.NukeSped
Create hunting rule
Status:
Malicious
First seen:
2020-08-26 18:47:55 UTC
File Type:
PE (Exe)
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1d452b5f3e5d2b6623d0ca35793dfc051e1bf8b237e360906ed055e819235604
5978884a07ea7559941ec2a1ce86e08e4be36a9aae9d535f58021602b24cdaba
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201002-yrankqc6ra/
Unpacked files
SH256 hash:
aca598e2c619424077ef8043cb4284729045d296ce95414c83ed70985c892c83
MD5 hash:
dfd09e91b7f86a984f8687ed6033af9d
SHA1 hash:
b8fe7884d2dc4983fb0fbca192694ce2f4685e23
Detections:
win_nachocheese_auto
Create hunting rule
Link:
https://www.unpac.me/results/ce961bb4-6441-4523-96b3-1913aa6f52b3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NukeSped
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aca598e2c619424077ef8043cb4284729045d296ce95414c83ed70985c892c83

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:decoded_PolishBankRAT_fdsvc_strings
Create hunting rule
Author:Booz Allen Hamilton Dark Labs
Description:Finds hard coded strings in PolishBankRAT_fdsvc
Rule name:win_nachocheese_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/67670/

Comments