MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b604f76daf8cf56c371dbfc20bbeff0ab2d451d9fa059615682a0c6054bf1627. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b604f76daf8cf56c371dbfc20bbeff0ab2d451d9fa059615682a0c6054bf1627
SHA3-384 hash: 9766f647e7d8bb6dbfe05c4e522d9961b796d7a29ec1dead1625c174466f484a3dd8db16660c24c074df8885128aeb75
SHA1 hash: 6a6664e39d55c62ee7f05c50c71265b965f7d1d2
MD5 hash: f507817d13824d08830760bf1017945e
humanhash: montana-blossom-montana-white
File name:b604f76daf8cf56c371dbfc20bbeff0ab2d451d9fa059615682a0c6054bf1627
Download: download sample
File size:302'220 bytes
First seen:2020-11-07 20:03:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ef3fd1c1a81435e51fcc42212e25d2ec (7 x Reconyc)
ssdeep 6144:SsP+XCh2z7dGe4ZeKoV9nIoap3a5DMH/CV40K5OoYgar1:SsmShw4aV9IplatRVW5Sr1
Threatray 13 similar samples on MalwareBazaar
TLSH 6C549DACE1D03D67EAEF2DF50B7C9A624D5243CD17BF4E46840A28AD0F5638481E6877
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Razy-6913220-0
Create hunting rule

Win.Malware.Razy-6913467-0
Create hunting rule

Win.Packed.Razy-9490248-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Replacing executable files
Moving of the original file
Deleting of the original file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b604f76daf8cf56c371dbfc20bbeff0ab2d451d9fa059615682a0c6054bf1627/
Gathering data
Verdict:
malicious
Similar samples:
06e145e0068c9631d558c1f1c04b51fe8c6a36052a6a051986642eb0dec85232
0d00922fa0ec170439504b0694cc584c76702d9e9b5c7bf83f5b887755ddecb2
1f2efa2a023e42852e744c68ec659295448900f471a47032610a9493dc1a1f85
296b64f00dfe0aacad6cb5b400caf51f90f0129fb07e1afc71abc0d3a2b1b1a5
3075a769f000372501a625d5073892f6a1c7363fe4ec5751658d7bc00561d0ff
59eb4977b433ca77f1590c094dead7cf6bfc1cee4ece19ec994af25d918b54b9
75da456980b6c16a80a05269d6fee93bc18a242ebe0c7f9f014bad8828b09291
8d5fcc37dd8243986f9bb28dccd74960163c965f87f23fc4e0360f17188cc332
921b899e4c61812633ba9ed76783c4083de7ca1922f6eaac6215d6940d9aa2b7
9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f
+ 3 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201108-9gyml3xls6/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Deletes itself
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments