MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d00956a63d7e56ec5fc098fdc2227523e3022cae1f144c783d64044366d0789c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d00956a63d7e56ec5fc098fdc2227523e3022cae1f144c783d64044366d0789c
SHA3-384 hash: 55db75a3cbee1129440b1767854ea0cc02ff83e3a9499069141ba7a83ae0147a5c40628b90d2bfdfa53c711afc57e414
SHA1 hash: 6e0abd5fb773e339128f1a9a5828d19097491d8c
MD5 hash: 8f9dcd3767ab979a0f9f71cef8322175
humanhash: spaghetti-four-helium-four
File name:8f9dcd3767ab979a0f9f71cef8322175.exe
Download: download sample
File size:385'024 bytes
First seen:2021-08-13 14:32:50 UTC
Last seen:2021-08-13 16:08:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0fef022f94fc67f880d838c0182f1263 (2 x Smoke Loader, 2 x DanaBot, 1 x RedLineStealer)
ssdeep 6144:5QLm1X333u53fExSEKrTNIAjMtkKogbutXVEBdzuOROmZXNCi:Wal333u5fExSEGIKubutyqOL8i
Threatray 35 similar samples on MalwareBazaar
TLSH T11584F0D17A83D4BEC487D0F0252C86B16B3CA8605A14098FA7453F2EAE3369352FE7D5
dhash icon 4839b2b4e8c38890 (137 x RaccoonStealer, 37 x Smoke Loader, 30 x RedLineStealer)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8f9dcd3767ab979a0f9f71cef8322175.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-13 14:35:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/629570df-b750-4f05-ae65-689b66ba4bf7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/179015/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.28521.3834.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b39e1af2-a572-42ed-8f27-04d1e489f4de
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/832501
Signature
Contains VNC / remote desktop functionality (version string found)
Creates autostart registry keys with suspicious names
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 464934 Sample: RjXkW9e3G7.exe Startdate: 13/08/2021 Architecture: WINDOWS Score: 92 46 spinogriz91076299.io 2->46 48 kpotuvorot10.bit 2->48 50 gorokborotun782699.com 2->50 62 Multi AV Scanner detection for submitted file 2->62 64 Machine Learning detection for sample 2->64 66 Contains VNC / remote desktop functionality (version string found) 2->66 8 RjXkW9e3G7.exe 2 4 2->8         started        12 33A2E4F0.exe 2->12         started        14 33A2E4F0.exe 2->14         started        signatures3 process4 file5 42 C:\ProgramData\...\33A2E4F0.exe, PE32 8->42 dropped 68 Detected unpacking (changes PE section rights) 8->68 70 Detected unpacking (overwrites its own PE header) 8->70 72 Creates autostart registry keys with suspicious names 8->72 16 33A2E4F0.exe 8->16         started        signatures6 process7 dnsIp8 44 ebanat6977769.com 8.209.79.46, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 16->44 54 Multi AV Scanner detection for dropped file 16->54 56 Detected unpacking (changes PE section rights) 16->56 58 Detected unpacking (overwrites its own PE header) 16->58 60 2 other signatures 16->60 20 WerFault.exe 9 16->20         started        24 WerFault.exe 9 16->24         started        26 WerFault.exe 9 16->26         started        28 3 other processes 16->28 signatures9 process10 dnsIp11 52 192.168.2.1 unknown unknown 20->52 30 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 20->30 dropped 32 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 24->32 dropped 34 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 26->34 dropped 36 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 28->36 dropped 38 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 28->38 dropped 40 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 28->40 dropped file12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d00956a63d7e56ec5fc098fdc2227523e3022cae1f144c783d64044366d0789c/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-08-13 11:38:29 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
2e3b767101904dd4352ece4ac162a9253edc02609db93ef70801e3a6fe1268f4
50f02c9841c7e3215d91c1ec926ebc3863d76a664899e742b0a4a7a74cc4368e
5521400dffe660536524b06e28edc0805136092457722f3e1246a8749a0a7471
596e82d24c64a373095159ee769df582d6f34fde24eb537aca442d8f01c491db
786b9cb2fa5e78e4bc0d9e67e6f90c0229b150bacfd3e75cf46a9c3a67d57a67
82d08c29cb4e61dbe7455ff966f20e33f16e941341790363c00c3d261d4def11
9f1c935d143a59d2429f2681007c61ee07504302e5798d7abdb9a5d44d90e13b
a8e2a996c913eb390bd0074d461a97156ad7395ae5ca856c2a6e6c14be534e2d
c9052a72f8d94fabf633aa750a1f7dbf0f211ef4be463443d2d064ffa8bb79d7
cceb5da1ebba042d949f4afef5f5e4638826493201564245be0448920dac639c
+ 25 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/210813-2crdasycba/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
8fe1877b2cb312eaa3b1fd4b10bcd9c4050a86f55b602704db3a6a453ff0e7a8
MD5 hash:
2ec55de670faf40bbce8624884512519
SHA1 hash:
de87552e3af4bd3f9cd7baa93b652fc21c60b952
Link:
https://www.unpac.me/results/f3f1dfde-c9cb-47ac-8e10-cedd71abb156/
SH256 hash:
d00956a63d7e56ec5fc098fdc2227523e3022cae1f144c783d64044366d0789c
MD5 hash:
8f9dcd3767ab979a0f9f71cef8322175
SHA1 hash:
6e0abd5fb773e339128f1a9a5828d19097491d8c
Link:
https://www.unpac.me/results/f3f1dfde-c9cb-47ac-8e10-cedd71abb156/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d00956a63d7e56ec5fc098fdc2227523e3022cae1f144c783d64044366d0789c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe d00956a63d7e56ec5fc098fdc2227523e3022cae1f144c783d64044366d0789c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1525649/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/179015/

Comments