MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be703ee8d83c3eb95fd5a343fed3d2947d2b98955be3b6eb8dd4752be1047537. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be703ee8d83c3eb95fd5a343fed3d2947d2b98955be3b6eb8dd4752be1047537
SHA3-384 hash: 13a8b3841f422d7a24b19131e24e0d7de021d1d47fceab5e3ff77fd0bab21297947764a549e354c0f19d0f90b1613eb1
SHA1 hash: 7d69fd7e3eb693dc81778d58ea4c28af7997d341
MD5 hash: 735a251f921be84a2039cb2b58467e4e
humanhash: lithium-alabama-sad-nuts
File name:be703ee8d83c3eb95fd5a343fed3d2947d2b98955be3b6eb8dd4752be1047537
Download: download sample
File size:8'648'192 bytes
First seen:2020-07-06 15:20:58 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 95f3f0c1254e5a0297e8541620236a3a
ssdeep 196608:sMXIEdTOtWP30ZpWg0sgHOP+hmoevcMgpI8Iv8Tfa0bb/:sSrO+0nxPumogcRpIfv8e0X
Threatray 41 similar samples on MalwareBazaar
TLSH 0196336636A50196C1DFC9318E33FFA432F233BD978194B5A9856EC636712E0DA13E43
Reporter JAMESWT_WT
Tags:dll Lampion

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'765
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/21717/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be703ee8d83c3eb95fd5a343fed3d2947d2b98955be3b6eb8dd4752be1047537/
Threat name:
Win32.Trojan.Banbra
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 07:53:09 UTC
File Type:
PE (Dll)
Extracted files:
10
AV detection:
36 of 48 (75.00%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1e04c1e4eefe23f454553364e757209462f2561d8455628b296b1dbe83fc6ec2
203f753b4e81e49247f62c3f59e6744e6b7b3b0a399ebe7118b0fcc23c6ebf22
22a49fd2468178e5b33cad08985adde50f0530a33260affc58bee6b2401005a9
2b6160a9720ed2cf3b818dafc81e4f092111d4df2e0db161b994b39a5ceb78f3
434ea880ad59cffded73a776f3a01a75e6afef21fc6dca45b364fd3f0ba54de3
6a46de11b9ebaaa99cecd10012b7532e5d323d9ddf5bb25309f6fbf47f192fde
888750cee6858ec2c6131628caa562be26b1c65ecaeff4addcbf73a456c99517
8c195ec63793d4d4927cb5e06cd2c5771cedab32baecd2097454e3709e2748cc
b40c8fcb20acf66db418078f0d6099145b220dc056d095beb54665faf6c726c7
b52960b7ce7ae8c007c59626859816296471b7810036baaa7b7b86c2cd6d6218
+ 31 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
vmprotect
Link:
https://tria.ge/reports/200706-slsfhv1xfn/
Behaviour
VMProtect packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/sirpedrotavares/status/1280159056288641024?s=20
Cape
Cape
https://www.capesandbox.com/analysis/21717/

Comments