MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b50fb20396458aec55216cc9f5212162b3459bc769a38e050d4d8c22649888ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b50fb20396458aec55216cc9f5212162b3459bc769a38e050d4d8c22649888ae
SHA3-384 hash: 6570c6b20b0d75e7737f4289653d36cd7a9c303c7c6fc78bcdad11ba517be8af19caac638d4cf7a1982f1c1835115547
SHA1 hash: f1848b3c4fceb3cb38cce30c23b40a19acc793e7
MD5 hash: f49c0774f1ec84f33db771801eea1edf
humanhash: sad-fish-venus-don
File name:b50fb20396458aec55216cc9f5212162b3459bc769a38e050d4d8c22649888ae
Download: download sample
File size:27'648 bytes
First seen:2022-01-17 07:03:08 UTC
Last seen:2022-01-17 08:45:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3a2a2de20daa74d8f6921230416ed4e6
ssdeep 384:hgvApUHEZKu08YtQI4GS1dxRBUHCHCHCnCHCHCHiHCHCHCHCHCHCHCHCH/skp2BD:ivmUHEZ4yVUiiiCiiCiiiiiiiidpd
Threatray 96 similar samples on MalwareBazaar
TLSH T117C22A89F2494DE9F062C7B514DB9FB2EE62992244116BA3CB2DE3BCCE3B3415D13521
Reporter JAMESWT_WT
Tags:exe WhisperGate

Intelligence

File Origin
# of uploads :
2
# of downloads :
302
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b50fb20396458aec55216cc9f5212162b3459bc769a38e050d4d8c22649888ae
Verdict:
No threats detected
Analysis date:
2022-01-17 07:09:24 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/473e6ea6-6edf-4233-92a9-4aeaeea5e542

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/219728/
Detection(s):
SecuriteInfo.com.Trojan.Win32.DiskWriter.4c.20397.28009.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Rewriting of the hard drive's master boot record
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/4422/overview
Behaviour
MalwareBazaar
CPUID_Instruction
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug apt diskwriter
Link:
https://www.filescan.io/uploads/61e514e60f8c757253c34d33/reports/ab570e86-4bfe-4929-bfe9-545303683119/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1babdf6d-5116-47dc-a331-0a8b989ba7f0
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/921579
Signature
Contains functionality to access PhysicalDrive, possible boot sector overwrite
Contains functionality to infect the boot sector
Infects the VBR (Volume Boot Record) of the hard disk
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Writes directly to the primary disk partition (DR0)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b50fb20396458aec55216cc9f5212162b3459bc769a38e050d4d8c22649888ae/
Threat name:
Win32.Trojan.KillMbr
Create hunting rule
Status:
Malicious
First seen:
2022-01-17 07:04:08 UTC
File Type:
PE (Exe)
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
08e34fc9a01f4fd9017b61612d5eac56f1a28945c48d40908da62e430ac9a7d0
0c7aaf3999899c4f29ea325f11746ab98462151fa78a15b8ca505973ac71fd02
10a5bbeeb39216bde492a246b1b003bcb2d7c0895dea287b5f8ad4f3428ef3cc
3b17e1d94b70f6d8fc6b56071259a9affacc235a92d7a772b27ddd0c01783d4a
4a0f52dab31cc96ebe813dfce03401b5813d10153ffd805ba61b06cb169eee6a
a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92
b425fcfcab98d57a198166faa21768b84e6ab8c75d3864375eed40ca4162fdc0
be97f2438f11faa0b836f9e01570d20e1e21c981c858a6bc8e144d6ced8c4157
+ 86 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
bootkit persistence
Link:
https://tria.ge/reports/220117-hvysdaghg4/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Writes to the Master Boot Record (MBR)
Unpacked files
SH256 hash:
b50fb20396458aec55216cc9f5212162b3459bc769a38e050d4d8c22649888ae
MD5 hash:
f49c0774f1ec84f33db771801eea1edf
SHA1 hash:
f1848b3c4fceb3cb38cce30c23b40a19acc793e7
Link:
https://www.unpac.me/results/e3b5aa7d-dde4-4ec8-8fca-cc320e792b44/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b50fb2039645/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b50fb20396458aec55216cc9f5212162b3459bc769a38e050d4d8c22649888ae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/219728/

Comments