MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b85e8b8a34dff3159a06820ea87362e8ef861c8fc6031ab335622e29d34e5190. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b85e8b8a34dff3159a06820ea87362e8ef861c8fc6031ab335622e29d34e5190
SHA3-384 hash: e7886bed9e28e1f8d0ac16c440a188522d0a2e7c2d7fa050e0890096dfb67602bf39833a0727df40f2dcaf9570bda7a7
SHA1 hash: d3e243f57d453b4e36083947997774e2824ffe6b
MD5 hash: e05a43b1252295f7b5b3db2e40158497
humanhash: vegan-failed-music-aspen
File name:SOA.exe
Download: download sample
File size:501'140 bytes
First seen:2021-02-25 14:02:44 UTC
Last seen:2021-02-25 16:12:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ced282d9b261d1462772017fe2f6972b (127 x Formbook, 113 x GuLoader, 70 x RemcosRAT)
ssdeep 12288:F0qPZAz/xBhOqH9ew1KOJvdVhDmrF+E9aahw6mhhlQitXxWtOI:HPKzprHXV9eF+EPhwLmAe
Threatray 299 similar samples on MalwareBazaar
TLSH 22B423F52A10C5BBF1A3A1B1547706DE19B4E35120000F079B7A1EC8AE73AF2A61F7E1
Reporter James_inthe_box
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SOA.exe
Verdict:
Malicious activity
Analysis date:
2021-02-25 14:06:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5f98ef9e-e7a2-4d5c-8133-7029a4d6641b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/119238/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a UDP request
Unauthorized injection to a recently created process by context flags manipulation
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/618772
Signature
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 358384 Sample: SOA.exe Startdate: 25/02/2021 Architecture: WINDOWS Score: 64 21 Multi AV Scanner detection for dropped file 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 Machine Learning detection for sample 2->25 7 SOA.exe 11 2->7         started        process3 file4 17 C:\Users\user\AppData\...\prhv2mhm1p.exe, PE32 7->17 dropped 19 C:\Users\user\AppData\...\ambnfsjncyq.dll, PE32 7->19 dropped 10 prhv2mhm1p.exe 1 7->10         started        process5 signatures6 27 Maps a DLL or memory area into another process 10->27 13 prhv2mhm1p.exe 3 10->13         started        15 conhost.exe 10->15         started        process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b85e8b8a34dff3159a06820ea87362e8ef861c8fc6031ab335622e29d34e5190/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-25 02:10:51 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
19 of 25 (76.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xbpixcru37zrlgqgqihkq43c5dxymhepyybrvmzvmixctu2okgia._file
Verdict:
unknown
Similar samples:
0f71c0c7cbcced9dd1ac18023d8a7849b301916e4e6b71709fd32423a8cc0a0f
2266abc88d7421b5b3ba4c8691d6ae3ca4a0950710fbb1ad37e78a5785b09097
448f88754d3e78d9a62466932ffaca59115697f662a23697ddbba24d112b817c
4ee463200a2e23f5f8cd27820da94a17de71dfbcdd4793524262d6ab2099b44c
563bb7942710f08ce409f8418fd0d917877998c978ab0155cb3c1b5eec3b1e7b
59c97ea0fbef598a5804eafdfa5b625bb17c15d55ca347bb1e63c4e980294130
d092a60d031f2dfa8d009742db3f7d78d34d817f9c6be57a7b21469203a48dc3
d47d09a9514e4de8ab5aafb93c803ce2f7dfa93461681aa1f28d86a50c6fcbe8
e92125c96b4bee95fd7b70d867271510071f812699733de75dd5e64636030314
f1ef7bfbc6454672e2ab4f40483322eef2a9a096a83b0e520087da8c83250f64
+ 289 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210225-q8q6n58jc2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
e190ad5b5384ff09cd299b714c668f8cbdd428416236fce761efb626810227f0
MD5 hash:
6837e37e996dec676b2e2d14f3acd9a7
SHA1 hash:
a20cf4aaf6910481ac613ebf32aa96b24667629e
Link:
https://www.unpac.me/results/56cabf31-d639-475c-8fbc-82e5e81bb8dd/
SH256 hash:
c3e8fd48c7c175936dd9e7481c892ab5a3cd2aadeb643d264224c3dfe7095a89
MD5 hash:
d1e12e3c51fec6f539ae3fc7189ba4c9
SHA1 hash:
0de859143bf88344d8a3be60348e7a6f4e8d6ecf
Link:
https://www.unpac.me/results/56cabf31-d639-475c-8fbc-82e5e81bb8dd/
SH256 hash:
b85e8b8a34dff3159a06820ea87362e8ef861c8fc6031ab335622e29d34e5190
MD5 hash:
e05a43b1252295f7b5b3db2e40158497
SHA1 hash:
d3e243f57d453b4e36083947997774e2824ffe6b
Link:
https://www.unpac.me/results/56cabf31-d639-475c-8fbc-82e5e81bb8dd/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/119238/

Comments