MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccf93828e1b44a75820989d72a2c019ae3b0a98944bf9eb1884e77f16050c53f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccf93828e1b44a75820989d72a2c019ae3b0a98944bf9eb1884e77f16050c53f
SHA3-384 hash: d6fb85e5eced657a82c0e21b1e940b269be616a0b4415cb91b7ade087c60e29538faf64b2b418cf8394342c4143fef6c
SHA1 hash: fdd9685bf3a30918f71e1653250ba0d1bec1a38b
MD5 hash: b96f79eb633d0b2c0e79e6d889dac0da
humanhash: freddie-fix-oregon-mike
File name:ccf93828e1b44a75820989d72a2c019ae3b0a98944bf9eb1884e77f16050c53f
Download: download sample
File size:69'968 bytes
First seen:2020-11-24 12:47:59 UTC
Last seen:2020-11-25 06:37:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 388a48df63be252297c128975d85ffb6
ssdeep 768:K1m0OvFU4ThK4n9m4YQdX+sx4JMbAK5IP9shNPeED0CnUYimuaMje55voslL2hjl:um0ANBl43w2ahNPh5MQ5RlLCj1wpw
Threatray 13 similar samples on MalwareBazaar
TLSH 8D637C15F58A8433E9A36A341AF4C1B69A7E7A011B7440C73B984D695FF1BD18E3833B
Reporter JAMESWT_WT
Tags:Insta Software Solution Inc. KILLAV signed

Code Signing Certificate

Organisation:AAA Certificate Services
Issuer:AAA Certificate Services
Algorithm:sha1WithRSAEncryption
Valid from:Jan 1 00:00:00 2004 GMT
Valid to:Dec 31 23:59:59 2028 GMT
Serial number: 01
Intelligence: 383 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
168
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:

Behaviour
Running batch commands
Creating a process with a hidden window
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
51 / 100
Link:
https://www.joesandbox.com/analysis/545978
Signature
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
Uses cmd line tools excessively to alter registry or file data
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 322085 Sample: ybJ9RVyGO8 Startdate: 24/11/2020 Architecture: WINDOWS Score: 51 37 Antivirus / Scanner detection for submitted sample 2->37 39 Multi AV Scanner detection for submitted file 2->39 7 ybJ9RVyGO8.exe 1 2->7         started        process3 signatures4 41 Detected unpacking (changes PE section rights) 7->41 10 cmd.exe 1 7->10         started        13 cmd.exe 1 7->13         started        15 cmd.exe 1 7->15         started        17 8 other processes 7->17 process5 signatures6 43 Uses cmd line tools excessively to alter registry or file data 10->43 19 conhost.exe 10->19         started        21 reg.exe 1 10->21         started        23 conhost.exe 13->23         started        25 reg.exe 1 13->25         started        33 2 other processes 15->33 27 conhost.exe 17->27         started        29 conhost.exe 17->29         started        31 conhost.exe 17->31         started        35 7 other processes 17->35 process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ccf93828e1b44a75820989d72a2c019ae3b0a98944bf9eb1884e77f16050c53f/
Threat name:
Win32.Trojan.Deapax
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 01:28:56 UTC
File Type:
PE (Exe)
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
20f74016f44481b525fa57d676d52355f86b4f175350eebeb6e9a9215b36b45b
30dcc7a8ae98e52ee5547379048ca1fc90925e09a2a81c055021ba225c1d064c
389e03b1a1fd1c527d48df74d3c26a0483a5b105f36841193172f1ee80e62c1b
3d94c4a92382c5c45062d8ea0517be4011be8ba42e9c9a614a99327d0ebdf05b
68eb2d2d7866775d6bf106a914281491d23769a9eda88fc078328150b8432bb3
6a15e26804644d8c13c19260e449186899050e513b6be6ae5ef65ed799906dca
850a2090e3dd9c23f4777035a6e98a4ecbfd305b380c16645cf5d5a48dbd062b
94b76ce34e5493bb59586b41f41b23baa07a55f2397e80775573714b1311103c
b4afc259d1032bf4ac6db0092d7b364fb11458a4c2100aa2606df6d81e5d5122
b670441066ff868d06c682e5167b9dbc85b5323f3acfbbc044cabc0e5a594186
+ 3 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion trojan
Link:
https://tria.ge/reports/201124-pnnv2vngre/
Behaviour
Suspicious use of WriteProcessMemory
Modifies Windows Defender Real-time Protection settings
Unpacked files
SH256 hash:
ccf93828e1b44a75820989d72a2c019ae3b0a98944bf9eb1884e77f16050c53f
MD5 hash:
b96f79eb633d0b2c0e79e6d889dac0da
SHA1 hash:
fdd9685bf3a30918f71e1653250ba0d1bec1a38b
Link:
https://www.unpac.me/results/81c08103-ecd6-4191-808d-df59d445d2e8/
SH256 hash:
721deeff99567c0baa0cf3acbc9ef5c0d66a2eff5993a7f73b81fcbfa5238b3e
MD5 hash:
9d458b6835ea58e12d7e17b61fe6609b
SHA1 hash:
5bf2734a723cfcd9a1d08e241af6528d8bc1fdf6
Link:
https://www.unpac.me/results/81c08103-ecd6-4191-808d-df59d445d2e8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Gamarue
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ccf93828e1b44a75820989d72a2c019ae3b0a98944bf9eb1884e77f16050c53f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments