MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Patchwork


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57
SHA3-384 hash: 1daed8a04fd36a13936da650cdf1e51457290784e0242de8935e3719cec95feb80ffa22d66be09f34b18dafd275ad65a
SHA1 hash: 10fc5bbd2f801251d1228e6b3b35d24c6e018162
MD5 hash: 8b282ef8f441ccceb707a9ee04a5413e
humanhash: mobile-island-montana-carbon
File name:cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57
Download: download sample
Signature Patchwork
Create hunting rule
File size:243'361 bytes
First seen:2020-08-29 08:27:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 79cf8ca8dd4dad9d47e49beb5c9bbd50 (1 x Patchwork)
ssdeep 6144:oeLc9VV0liQ9KM5uVEgqz/ZnMmwqFlYiJB:owcDV0lilM5MqVMwbYiP
Threatray 4 similar samples on MalwareBazaar
TLSH 4234C03BFBDF64F1E72797752BC5E03B56E4BC27502BD612EBEA2A24D422031114B902
Reporter JAMESWT_WT
Tags:apt BozokRAT Edited Patchwork

Code Signing Certificate

Organisation:Accelerate Technologies Limited
Issuer:COMODO RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:Oct 3 00:00:00 2018 GMT
Valid to:Oct 3 23:59:59 2019 GMT
Serial number: ED2C6357AB79F222FC1B1311A02BB5C2
Thumbprint Algorithm:SHA256
Thumbprint: 79E4AFA77636B16A9BADC3B9F4061E769394E0588E7D5775129775C6497D1DE5
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
JAMESWT_WT
Edited BozokRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/52840/
Detection(s):
PUA.Win.Downloader.Driverpack-6717506-0
Create hunting rule

SecuriteInfo.com.BackDoor.Spy.3674.6684.25888.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/454228
Signature
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57/
Threat name:
Win32.PUA.LoadMoney
Create hunting rule
Status:
Malicious
First seen:
2019-09-24 03:50:07 UTC
File Type:
PE (Exe)
AV detection:
31 of 48 (64.58%)
Threat level:
  1/5
Verdict:
suspicious
Similar samples:
871e90a64852a59a33ae1e9cf32b09dc97d37edd27ac6478d51ca20363ad0529
Patchwork
a2976291bd9d3b613e6a026e9edb9f6ea1385d64429289443a6df08764b29464
Patchwork
c23b098a627d1c8449fad6756007c3b2a7ae20c3e70c74bbe4154c8b1651c84e
Patchwork
dfe18346db405af2484064e80b5c0124bc80ca84d39b90e1aa5d5592c479a904
Patchwork
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/200829-srk9q9pera/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Drops startup file
Loads dropped DLL
Drops startup file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Loadmoney
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/cc8867a5fd62b82e817afc405807f88716960af5744040999b619b126a9ecf57

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_badnews_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_coredn_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/52840/

Comments