MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd92100b5eee9f485facad22250d11ba811455710d2ca07e731f4d19741a571d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd92100b5eee9f485facad22250d11ba811455710d2ca07e731f4d19741a571d
SHA3-384 hash: 4d161798a560f3fa2c4a1effb36ee3b7d60bfdae314e36cc608c65535dd20072d5ecc8819ffd980cff29552e8f7900b8
SHA1 hash: 980399ca13d2f25bc5f0074df0467575616d1874
MD5 hash: ce692f51431d1cc83dc5e9368d2463e3
humanhash: cat-zulu-foxtrot-burger
File name:Sqli dumper v10.2.exe
Download: download sample
File size:2'222'323 bytes
First seen:2020-08-03 11:16:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 49152:aHES9llSHcoyyWKoveeb0DogQep8smdeYwCOdaIMlzpr:aHEKS8GW5HJEpzxYwCWwt9
Threatray 356 similar samples on MalwareBazaar
TLSH D7A52302B6D19872D4325AB41A35E260AA7DBC201F25D79FD3F08C2FFA795C169347A3
Reporter theDark3d
Tags:NjRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/37734/
Detection(s):
SecuriteInfo.com.BackDoor.SiggenNET.5.27436.8753.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Sending a UDP request
Unauthorized injection to a recently created process
Result
Threat name:
LimeRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/407799
Signature
.NET source code references suspicious native API functions
Binary contains a suspicious time stamp
Connects to a pastebin service (likely for C&C)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates files with lurking names (e.g. Crack.exe)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Protects its processes via BreakOnTermination flag
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected LimeRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 256112 Sample: Sqli dumper v10.2.exe Startdate: 03/08/2020 Architecture: WINDOWS Score: 100 44 cdn.onenote.net 2->44 46 asf-ris-prod-neurope.northeurope.cloudapp.azure.com 2->46 66 Yara detected LimeRAT 2->66 68 .NET source code references suspicious native API functions 2->68 70 Machine Learning detection for sample 2->70 72 5 other signatures 2->72 9 Sqli dumper v10.2.exe 10 2->9         started        13 chrome.exe 3 2->13         started        signatures3 process4 dnsIp5 38 C:\...\SQLi_Dumper_Cracked_By_Angeal.exe, PE32 9->38 dropped 40 C:\Users\user\AppData\Local\...\Fortnite.exe, PE32 9->40 dropped 76 Creates files with lurking names (e.g. Crack.exe) 9->76 16 Fortnite.exe 15 5 9->16         started        21 SQLi_Dumper_Cracked_By_Angeal.exe 1 9->21         started        54 104.23.98.190, 443, 49737 CLOUDFLARENETUS United States 13->54 56 pastebin.com 13->56 78 Machine Learning detection for dropped file 13->78 80 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 13->80 82 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 13->82 file6 signatures7 process8 dnsIp9 42 pastebin.com 104.23.99.190, 443, 49730, 49735 CLOUDFLARENETUS United States 16->42 34 C:\Users\user\AppData\Local\Temp\chrome.exe, PE32 16->34 dropped 58 Protects its processes via BreakOnTermination flag 16->58 60 Machine Learning detection for dropped file 16->60 62 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 16->62 64 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->64 23 chrome.exe 16->23         started        28 schtasks.exe 1 16->28         started        30 WerFault.exe 23 9 21->30         started        file10 signatures11 process12 dnsIp13 48 xbu4vv8ayujduoon3a.ddns.net 194.5.98.46, 49738, 8808 DANILENKODE Netherlands 23->48 50 pastebin.com 23->50 36 C:\Users\user\AppData\Local\...\IconLib.dll, PE32 23->36 dropped 74 Protects its processes via BreakOnTermination flag 23->74 32 conhost.exe 28->32         started        52 192.168.2.1 unknown unknown 30->52 file14 signatures15 process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd92100b5eee9f485facad22250d11ba811455710d2ca07e731f4d19741a571d/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 11:18:07 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
01f936785968394ba82a93a816c897d77879a247b12621b42e12b2a7592a4f6d
1ca9978db84d8cad7f6a8f838e106799352c386cfa3aee2bbefa195e7fabe166
3a61804bb8302d42eb46c25a884cf50e7e6e383a9a48bfbfb1cfbe78ed2ed389
5e4cb5b794577345c50a2012ee0ece2301012527d17646d984a253781bcd39c9
62a7f441ba21aaa568fe700029fa32d6dd7eeb2ed0a7f7259a680f2aae65ee31
6d833bd671f179c8dfdf89aac0bc77cd7bb49f82a98cbf5d8122a9d47fa98e9f
829b3df0c75971b19d658fd980bdf0302351bdf6ddbdf5e2f5d83632df72215d
9ee1ed01fe26af330a114bc5d39fdfb3a6357a75b8091a234d115bf2230256c3
c366104c944aee48c742218be05de134d13fd7bde6024b1c0f4c1d843b2288f8
e571cd3a4c0744cb3c5443b868577adced331a7545fcb6e2ed0efbe7506a2f9b
+ 346 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200803-6rztkrtyve/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cd92100b5eee9f485facad22250d11ba811455710d2ca07e731f4d19741a571d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/37734/

Comments