MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af9ef6c6b1415663825f1f3b3e5e9c46c3511d887688f3e16d58813fbd63db1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af9ef6c6b1415663825f1f3b3e5e9c46c3511d887688f3e16d58813fbd63db1b
SHA3-384 hash: a470d6141d9d82d475389ef6dfca856a1eddb931dfdc74bc60bcff3aed20edbe963617770d420a6dbe8dc4ed64d9b132
SHA1 hash: 0dd4c010a8a5ba43e499402bf04377960cbeea0a
MD5 hash: 1958458dd5c9fe09ee362803819f9ab8
humanhash: shade-fifteen-venus-muppet
File name:af9ef6c6b1415663825f1f3b3e5e9c46c3511d887688f3e16d58813fbd63db1b
Download: download sample
File size:5'878'272 bytes
First seen:2021-02-11 11:11:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4f8773ac53a33a1308882323899130ae
ssdeep 98304:aOElMNCl9zqWN+8QwbsAak5HMwA7a3nVymbK9lFT+GHC:F6r9N+8Psdk5sx7a3nM7
TLSH 7D4622FE614C371CC45EC8709523BC19B2B7131E1AE689BA75CBBBE0B7DA4219705B42
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
af9ef6c6b1415663825f1f3b3e5e9c46c3511d887688f3e16d58813fbd63db1b
Verdict:
No threats detected
Analysis date:
2021-02-11 11:17:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/12c8997b-0058-4121-b5b2-34fde3349212

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/116812/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Mimikatz
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/605758
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect virtualization through RDTSC time measurements
Yara detected Mimikatz
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af9ef6c6b1415663825f1f3b3e5e9c46c3511d887688f3e16d58813fbd63db1b/
Threat name:
Win64.Hacktool.Mimikatz
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 03:27:36 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
14 of 29 (48.28%)
Threat level:
  1/5
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210211-c4v5bwynja/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
af9ef6c6b1415663825f1f3b3e5e9c46c3511d887688f3e16d58813fbd63db1b
MD5 hash:
1958458dd5c9fe09ee362803819f9ab8
SHA1 hash:
0dd4c010a8a5ba43e499402bf04377960cbeea0a
Link:
https://www.unpac.me/results/7217372a-3ab7-4cd7-95cf-2d4fabcf0e32/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Mimikatz
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/af9ef6c6b1415663825f1f3b3e5e9c46c3511d887688f3e16d58813fbd63db1b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/116812/

Comments