MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b35e23599a0c1f88bc04a1a656aa158fda2fc46750d810bfe6801f96cdbec0fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | b35e23599a0c1f88bc04a1a656aa158fda2fc46750d810bfe6801f96cdbec0fa |
|---|---|
| SHA3-384 hash: | c33f3fa72c84ee47352248093cb2cad5efbd6d9e58443df6b5fd602e4ee80d203890563d28be82de8a5ef45f021e2e11 |
| SHA1 hash: | e2f42f1520058593d93e5378760724f918705b04 |
| MD5 hash: | 7a8ff582c7e91af4c10019b82ada67b4 |
| humanhash: | music-tango-kilo-oranges |
| File name: | SecuriteInfo.com.Program.Win32.Wacapew.Cml.19599.29480 |
| Download: | download sample |
| File size: | 1'318'400 bytes |
| First seen: | 2021-11-17 20:21:01 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f4e7bb43f5590a96950cc8800ef7c885 |
| ssdeep | 12288:k63GNTFtSCQ8NLaVhGqEdxtsvoxR6polnJeGek1XAmb/VVyor5M1ITUHAS/JaNq8:dRQZrx1iKn27A0TqD4+ |
| Threatray | 31 similar samples on MalwareBazaar |
| TLSH | T11A552CAE9572129BFED34C35CDD8B2A1CA932A3D8D3BD5F25DA1D13028391A1ED07613 |
| Reporter |  SecuriteInfoCom |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
STATEMENT[2021.11.16_10-19].xlsb
Verdict:
Malicious activity
Analysis date:
2021-11-17 16:03:44 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Sending a custom TCP request
DNS request
Verdict:
Suspicious
Threat level:
5/10
Confidence:
67%
Tags:
packed
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Signature
Creates an autostart registry key pointing to binary in C:\Windows
Sigma detected: UNC2452 Process Creation Patterns
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Threat name:
Win64.Trojan.Generic
Status:
Suspicious
First seen:
2021-11-17 17:21:33 UTC
AV detection:
8 of 28 (28.57%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 21 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Runs ping.exe
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
b35e23599a0c1f88bc04a1a656aa158fda2fc46750d810bfe6801f96cdbec0fa
MD5 hash:
7a8ff582c7e91af4c10019b82ada67b4
SHA1 hash:
e2f42f1520058593d93e5378760724f918705b04
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe b35e23599a0c1f88bc04a1a656aa158fda2fc46750d810bfe6801f96cdbec0fa
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.