MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1f292df0cec2b326d9231003b603d80c5a41c0eebbd51e13ad6d57493a0ec8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1f292df0cec2b326d9231003b603d80c5a41c0eebbd51e13ad6d57493a0ec8b
SHA3-384 hash: 1ccb99e68d187d7bdf60d52f214710c17a01ab4f626b37bca3010651f59cfe8ccc577596f845480f7572d1e368928827
SHA1 hash: 05d39ea81b735484d13ec1e4b086b6ac539c9b06
MD5 hash: bb8e011a3f18d40849cba38714ea34aa
humanhash: winter-cola-muppet-bluebird
File name:a791759579e3fbed9020da4ec90942ac
Download: download sample
File size:3'264'513 bytes
First seen:2020-11-17 14:49:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ef3fd1c1a81435e51fcc42212e25d2ec (7 x Reconyc)
ssdeep 49152:acbrbwrZu9LrAegRbP77a4usjFu1gMZAP2p+fgbYUEksH+gJYUtuuLZmpYHd:XrbwrowT7o0Fu1W8XEfYKlmpY9
Threatray 79 similar samples on MalwareBazaar
TLSH AFE5E06D227B4883C81B2735A85EDFBB4161BE3C7AA7D275709072AF74613C58B07A34
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Razy-6724968-0
Create hunting rule

Win.Packed.Tiggre-9787401-0
Create hunting rule

Win.Packed.Malwarex-9792170-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Replacing executable files
DNS request
Sending a custom TCP request
Creating a file
Moving of the original file
Deleting of the original file
Result
Verdict:
0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b1f292df0cec2b326d9231003b603d80c5a41c0eebbd51e13ad6d57493a0ec8b/
Threat name:
Win32.Trojan.Symmi
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 14:51:35 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
032170e439e3cd6bc109ae3c7ff12ef8f29e6dd1f46d047da2d9041d892a63d1
1ebfad8fb0b23c73422d76527d9191dba2bdba248303ad05e884404fd133f7ae
3075a769f000372501a625d5073892f6a1c7363fe4ec5751658d7bc00561d0ff
3d4123b64abdd43b8b419e568239501feeb7201bf6bf97b4d6fba447a54d5115
4721929afd94b7a41b6e3a1085eb73f476c294699b772a72762f64601a06ae3f
473312ffebfedba134fb127faaccf6c0084c03d268f3f333e0722bff8cbaab3d
533cbcd2a2040f4533cde89d485ad966de8ebbc902a493adc79bfa82d5497a15
6e6701b9412bd1434570be69197b6ac9b962b98baab380637e212f36c1e20986
adcce5fe632ba6788b2538936984ba41069b5302b2c0983018353d2358746dc2
fb37815904e7bd9b4d995fa13ce852db1e7ad0c522565cb52a8f1c1d3804d439
+ 69 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201117-jaqdxgjda6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Program crash
Legitimate hosting services abused for malware hosting/C2
Deletes itself
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
b1f292df0cec2b326d9231003b603d80c5a41c0eebbd51e13ad6d57493a0ec8b
MD5 hash:
bb8e011a3f18d40849cba38714ea34aa
SHA1 hash:
05d39ea81b735484d13ec1e4b086b6ac539c9b06
Link:
https://www.unpac.me/results/2ef60d53-a6dc-4a21-acb3-67fad488ef34/
SH256 hash:
389a149f5351575549b934eea04a33c6a5ca63287902b980fba0ebc562c91e76
MD5 hash:
c3aa0cb996876ee523836309fe47b119
SHA1 hash:
7f480727590fd7279ab6a92b7b7cc3d1cb2b0617
Link:
https://www.unpac.me/results/2ef60d53-a6dc-4a21-acb3-67fad488ef34/
Parent samples :
b2488b2c5b57839b8dda99b6d19bfed796f37d4493c4ff82abb568ad1ae162b9
869235cd2119eb4c4e4bc58ee334517ea0b4c219c65ad2a9902cf025ae1cba5f
5a84d55c04129675dda9d2b83e254deceb8c0f9cf720afea60e5b2de4fbce2c7
bdc684dfd7854f15120612ef2dfe1c4314f4b0d017c8e09e807a5ad68cd9b2ac
6567ef2a99dbe0b79e954a0c5dd1c4b7c45a0fe2f0ad77a42ba07256ff069408
2a771b3df8f05f3872784c275c4e5fc9696eed8b418b1d774242b012e3d71048
SH256 hash:
8f1a496df33ac0c1725c9a358cad2c684486b694549b80d5bdfc609f871dc352
MD5 hash:
7851cba6cd9c93f44a21cccd3337fffc
SHA1 hash:
22e0d824cd02f5175ed4ea9a6f754a27ae11ec12
Link:
https://www.unpac.me/results/2ef60d53-a6dc-4a21-acb3-67fad488ef34/
SH256 hash:
c3489d73877080e15daed1b14d9c501fcef80a69ce0cd18af4cd7a0d5dbb38fa
MD5 hash:
5829583ffb030486b3651e0bd05412a1
SHA1 hash:
28874fea250e30e694c92b91401c1702bbe02bb4
Link:
https://www.unpac.me/results/2ef60d53-a6dc-4a21-acb3-67fad488ef34/
SH256 hash:
84aafe94cc6585d7f77ffcb413c85b979fb99633b3a6533272da86dec522b50b
MD5 hash:
f3e42c4f9359e8caffad6fbff3991bd5
SHA1 hash:
64983534b957ce30813b00d8db86f9b5d7629d2a
Link:
https://www.unpac.me/results/2ef60d53-a6dc-4a21-acb3-67fad488ef34/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments