MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ceb8f344d1cda9007bccb82a7d6c75dcd29e7d235cc64747707097bb28c8f317. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ShikataGaNai


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ceb8f344d1cda9007bccb82a7d6c75dcd29e7d235cc64747707097bb28c8f317
SHA3-384 hash: 7621158a59864326b785d799e2411245c915ea05331d72421d7a57b7475d66e46b1ed2e81b039e3e5542bab3440367d4
SHA1 hash: 50e77ed7c0d1be221430bdbe7a627d910afb40d1
MD5 hash: a4ae4b6aea313ec115785342343efe35
humanhash: lactose-nitrogen-mexico-cola
File name:ceb8f344d1cda9007bccb82a7d6c75dcd29e7d235cc64747707097bb28c8f317
Download: download sample
Signature ShikataGaNai
Create hunting rule
File size:73'802 bytes
First seen:2021-08-03 13:14:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 481f47bbb2c9c21e108d65f52b04c448 (257 x Meterpreter, 93 x Metasploit, 33 x ShikataGaNai)
ssdeep 1536:IJv1rVYa8kcZXcPgr0dIY1KtGF0NMb+KR0Nc8QsJq39:w1C4cZygUIxQF2e0Nc8QsC9
TLSH T1D573B043E9C41472C6A2117E27743EB66A74F5FB3602C24A764CDDE6DBD18B092263C7
Reporter JAMESWT_WT
Tags:54.94.248.37 exe ShikataGaNai

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ceb8f344d1cda9007bccb82a7d6c75dcd29e7d235cc64747707097bb28c8f317
Verdict:
Suspicious activity
Analysis date:
2021-08-03 13:17:12 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9e7d4b52-78e8-44f8-a4a1-6d2e761b19b6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/176058/
Detection(s):
Win.Trojan.Swrort-5710536-0
Create hunting rule

Win.Trojan.MSShellcode-6360728-0
Create hunting rule

Win.Trojan.MSShellcode-6360730-0
Create hunting rule

Win.Trojan.MSShellcode-6360729-0
Create hunting rule

BC.Win.Trojan.Swrort-17210
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Connection attempt
Sending a UDP request
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f17c4e7f-4700-40ad-a4e2-4f4006eed26c
Result
Threat name:
Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/826274
Signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Metasploit Payload
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ceb8f344d1cda9007bccb82a7d6c75dcd29e7d235cc64747707097bb28c8f317/
Threat name:
Win32.Backdoor.Meterpreter
Create hunting rule
Status:
Malicious
First seen:
2021-06-16 06:35:06 UTC
File Type:
PE (Exe)
AV detection:
25 of 27 (92.59%)
Threat level:
  5/5
Verdict:
unknown
Result
Malware family:
metasploit
Create hunting rule
Score:
  10/10
Tags:
family:metasploit backdoor trojan
Link:
https://tria.ge/reports/210803-xkntawttvs/
Behaviour
MetaSploit
Malware Config
C2 Extraction:
54.94.248.37:11577
Unpacked files
SH256 hash:
ceb8f344d1cda9007bccb82a7d6c75dcd29e7d235cc64747707097bb28c8f317
MD5 hash:
a4ae4b6aea313ec115785342343efe35
SHA1 hash:
50e77ed7c0d1be221430bdbe7a627d910afb40d1
Link:
https://www.unpac.me/results/8e2bb052-d477-4342-b8e9-ab19f88a5003/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ceb8f344d1cda9007bccb82a7d6c75dcd29e7d235cc64747707097bb28c8f317

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Hunting_Rule_ShikataGaNai
Create hunting rule
Author:Steven Miller
Reference:https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html
Rule name:Hunting_Rule_ShikataGaNai
Create hunting rule
Author:Steven Miller
Reference:https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/176058/

Comments