🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2fff992e40ce18ff81b9a92fa1cb93a56fb5a82c1cc428204552d8dfa1bc04f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2fff992e40ce18ff81b9a92fa1cb93a56fb5a82c1cc428204552d8dfa1bc04f
SHA3-384 hash: 3130a0281876f9721abe5346ffdaaedbc89b33fca97447f4cd9c3b0822d88b2eb4a916cacb0a83abbd237d084a010ea3
SHA1 hash: 31381d57d93b0c0738d2e92bce0014b69371f958
MD5 hash: 1aeb95215a633400d90ad8cbca9bc300
humanhash: saturn-missouri-red-november
File name:SecuriteInfo.com.ELF.Hildegard.40998.GC.24866.3159
Download: download sample
File size:3'135'320 bytes
First seen:2021-10-12 18:24:49 UTC
Last seen:2022-03-31 12:16:04 UTC
File type: elf
MIME type:application/x-executable
ssdeep 49152:Szjs+Ym3SV8lwXDFM7IU6i0r8Gtlqtz/nye+2eW6uR435rb2YbGUGp1Tb:SM+Ym3SV8yz+7z/Tx2uR4p/eUGp
TLSH T15BE55B237FE144BDC086D13C869FD1A3E974B8D80122B56B76846A213F37E605F7DA62
telfhash t1085250700db6b470b2d7d829b313e1756d335c6aa5fc36f02a229dd9edc4ac44cb6822
Reporter SecuriteInfoCom
Tags:elf

Intelligence

File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ELF.Hildegard.40998.GC.24866.3159.UNOFFICIAL
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/6165d31bfd35fe780c3b37eb/reports/73a86f8f-a696-4375-9c3b-c953dcb7269f/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
not packed
Botnet:
unknown
Number of open files:
7
Number of processes launched:
4
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/d2fff992e40ce18ff81b9a92fa1cb93a56fb5a82c1cc428204552d8dfa1bc04f
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Malware family:
Hildegard
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/75266a97-25fa-4f57-ba30-8e868796ec8f
Result
Threat name:
Fujinama RAT
Create hunting rule
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/869182
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d2fff992e40ce18ff81b9a92fa1cb93a56fb5a82c1cc428204552d8dfa1bc04f/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-11-19 03:01:58 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
linux
Link:
https://tria.ge/reports/211012-w2mwcadad3/
Behaviour
Reads runtime system information
Writes file to tmp directory
Modifies hosts file
Writes DNS configuration
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
CoinMiner
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/d2fff992e40ce18ff81b9a92fa1cb93a56fb5a82c1cc428204552d8dfa1bc04f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments