MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf1dffe7962afa228aa9aa767d1aed1962627111c4a970c957198a047581fdcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf1dffe7962afa228aa9aa767d1aed1962627111c4a970c957198a047581fdcc
SHA3-384 hash: 18e3614017277ac00cddce9c63f81573be3da0e3a48b8bcb41ddc610ef818d948306740cb88c3be07cbb6a7827d76fdd
SHA1 hash: be9f7b333acfe34ecc3c4efdd6bfd608f9f79e0b
MD5 hash: 77d463722ac098c1be866e7d1d5b620b
humanhash: thirteen-juliet-purple-angel
File name:575e2058cc843d4c6380d794ea40ced6
Download: download sample
File size:1'552'384 bytes
First seen:2020-11-17 12:28:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a215b529a6426ad298ca393c7a359bd2
ssdeep 24576:FpPzK+zYadGVstgQoKMQQAkI2zadcRj5zkTE6FLXvE8JUv85E5Oryqf4N4AlW826:fPzRcZ/qSSTCA7KXFmFBc7RxTJ
Threatray 1 similar samples on MalwareBazaar
TLSH 2D7512217997C273E07664F98C96C7F863D3F7A0AEEB0A0B704CD61D2A735E70962152
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Armadillo-38
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Using the Windows Management Instrumentation requests
Creating a window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf1dffe7962afa228aa9aa767d1aed1962627111c4a970c957198a047581fdcc/
Threat name:
Win32.Trojan.Black
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:31:52 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
5b2459c7aa6746f614a05a2797798fe09ecf294db3e2c1ddba33261e2f4acf8a
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/201117-qtn2g24tjn/
Behaviour
Suspicious use of WriteProcessMemory
ServiceHost packer
Unpacked files
SH256 hash:
bf1dffe7962afa228aa9aa767d1aed1962627111c4a970c957198a047581fdcc
MD5 hash:
77d463722ac098c1be866e7d1d5b620b
SHA1 hash:
be9f7b333acfe34ecc3c4efdd6bfd608f9f79e0b
Link:
https://www.unpac.me/results/7a3c142a-af95-42c2-b0a9-936b3022c989/
SH256 hash:
8d028a85a523f861d7a614bca95bd725c483e3de9b0d65b55f272b5e7c959e53
MD5 hash:
58ebf0721ed96ea4df87a0a32a6c41c4
SHA1 hash:
18d908df7e61782f8e90b05873baaf1dc767d5d5
Link:
https://www.unpac.me/results/7a3c142a-af95-42c2-b0a9-936b3022c989/
SH256 hash:
00a36c8308775cc2b7afc7f87b07419925d24869e813a8d80bfe4b8382a207bd
MD5 hash:
3600cf453a07b120415ab70a9dbbd847
SHA1 hash:
d67bb29d2115d149f9f9b0aefe55bf1d0651b80d
Link:
https://www.unpac.me/results/7a3c142a-af95-42c2-b0a9-936b3022c989/
SH256 hash:
c953833ebd28b499b67b7d79ea7660de1a4f7cd16784d4fed476f206d1821881
MD5 hash:
39634557e40666f301c9908e91219c70
SHA1 hash:
bfaa04c0514b4a75b0617d1f4a03015816730f04
Link:
https://www.unpac.me/results/7a3c142a-af95-42c2-b0a9-936b3022c989/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments