MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf22f585232c8fb2549d03c279becd4d3b761282dc0f62f3e367a9a9f1d415c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf22f585232c8fb2549d03c279becd4d3b761282dc0f62f3e367a9a9f1d415c7
SHA3-384 hash: 7722d2e9df4f51d56f521e0a26f813015df5629c01449f2cb78873a6384c9d9d16034af530df47e4366b7e74d5db1c1e
SHA1 hash: 13bcaee0466a5c45ff67b1abc806a61f09563ca6
MD5 hash: 5179892ef9b1df19211f82111f476723
humanhash: three-freddie-november-kitten
File name:5179892e_by_Libranalysis
Download: download sample
File size:166'400 bytes
First seen:2021-05-05 09:02:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cc42874e643acc63d2065c8bdc90f972
ssdeep 3072:oHaGEgq3EHIY8ThE6igttYxaKXJDlCoMM017UX5WsidCvtAzLULwZ:o+EoY826igtto1JRO37RoAk0
TLSH E5F3F11F78708054E18491350E359BE263B777A2833916E6429FBC2466CB3B4BA753EB
Reporter Libranalysis


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150105/
Detection(s):
Win.Trojan.Agent-7844366-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Blocking a possibility to launch for the Windows Task Manager (taskmgr)
Blocking a possibility to launch for the Windows registry editor (regedit.exe)
Blocking the Windows Security Center notifications
Blocking the User Account Control
Firewall traversal
Enabling a "Do not show hidden files" option
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Sality
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/97435a6d-e529-4f3b-ab54-fdb4bd70a705
Result
Threat name:
Sality
Create hunting rule
Detection:
malicious
Classification:
spre.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/711711
Signature
Antivirus / Scanner detection for submitted sample
Changes security center settings (notifications, updates, antivirus, firewall)
Disables the Windows registry editor (regedit)
Disables the Windows task manager (taskmgr)
Disables user account control notifications
Machine Learning detection for sample
May modify the system service descriptor table (often done to hook functions)
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Yara detected Sality
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf22f585232c8fb2549d03c279becd4d3b761282dc0f62f3e367a9a9f1d415c7/
Threat name:
Win32.Virus.Sality
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 01:10:18 UTC
AV detection:
31 of 31 (100.00%)
Threat level:
  5/5
Verdict:
unknown
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion trojan upx
Link:
https://tria.ge/reports/210505-a7q53dczbn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Drops file in Windows directory
Checks whether UAC is enabled
Windows security modification
Disables RegEdit via registry modification
Disables Task Manager via registry modification
UPX packed file
Modifies firewall policy service
UAC bypass
Windows security bypass
Unpacked files
SH256 hash:
03c71c59ff21a38706d77593e34be17b8bc81627c96b4927c2d5a59d84fbc8a3
MD5 hash:
5c757b24b2ca7f311e00c59f6689fe48
SHA1 hash:
3ac28e47ef6e0176f8d5986cb2b9d0b67b3950a2
Detections:
win_sality_auto
Create hunting rule
Link:
https://www.unpac.me/results/be14c1fe-0e70-4fad-b560-a30d09e8ee6b/
Parent samples :
65d452037fe5b0178ba3d8b1ae2f7b556d5a06f93e1079725637251fca3875cd
71ed493c4e9ccafab61103f900b151659da8222d9982f007d013134ac615b52f
bf22f585232c8fb2549d03c279becd4d3b761282dc0f62f3e367a9a9f1d415c7
868cba60184dd37a2f5382a7800b9bde8050f7ecbcab963db61f8517b81d413d
b7ba3f457b92a170afefec68895af36b77f72cf18438dde15318a27c3533db91
e1e6f19a68d81013710285bdd05d864100f9c81510c3141861035d7f4e53dc81
e894aaa26f75cc07ecdee02a0ed31f666382ef51efe6ed41bac5e77ac3b4d9ed
SH256 hash:
b3d86fbadea99e7bb9edd46fcdb716996dc507a63c2410ba13aab8da4df71fa4
MD5 hash:
a9829146874528c0b3777cda78f04699
SHA1 hash:
844b2a515a48c7b6f0c2d3421ca1c98f4e3d4234
Link:
https://www.unpac.me/results/be14c1fe-0e70-4fad-b560-a30d09e8ee6b/
SH256 hash:
bf22f585232c8fb2549d03c279becd4d3b761282dc0f62f3e367a9a9f1d415c7
MD5 hash:
5179892ef9b1df19211f82111f476723
SHA1 hash:
13bcaee0466a5c45ff67b1abc806a61f09563ca6
Link:
https://www.unpac.me/results/be14c1fe-0e70-4fad-b560-a30d09e8ee6b/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150105/

Comments