MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d693bdb8fc82b3385c47a02ef9ac465a2470c1f345a5f0b7dbd835c9c7b40115. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d693bdb8fc82b3385c47a02ef9ac465a2470c1f345a5f0b7dbd835c9c7b40115
SHA3-384 hash: 1ce97c341dde1809a9636444138a84149fc4da1b0d637cbd717cb448a828e8458c2d723d1e0675dafa0eb69f513280ce
SHA1 hash: 4a8a44719272b2bd5b067f6b3439bb23f7ec15c6
MD5 hash: dfe4e4a9d0d02a17fd575b94291dfcfa
humanhash: quebec-tennis-september-neptune
File name:mixazed_20210808-075823
Download: download sample
File size:14'848 bytes
First seen:2021-08-08 11:06:25 UTC
Last seen:2021-08-08 11:43:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ae4197a0f891759eaef7252707a54fa7
ssdeep 384:GEhQiqMOt/RzLo07xNqj/afC/ery7s62HG:iiqtt/Rzc07xEaBO7gHG
Threatray 6 similar samples on MalwareBazaar
TLSH T195624C83FF55C562EF9742761077A65285BBB1308FB58EC367806A190A782C0ED2F52F
Reporter benkow_
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
mixazed_20210808-075823
Verdict:
Malicious activity
Analysis date:
2021-08-08 11:08:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4ddcca1f-19da-45ed-90b1-e599fba30c63

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/177236/
Detection(s):
SecuriteInfo.com.Program.Win32.Wacapew.Cml.14951.30867.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Launching a process
Using the Windows Management Instrumentation requests
DNS request
Sending a UDP request
Connection attempt
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process with a hidden window
Deleting a recently created file
Launching the default Windows debugger (dwwin.exe)
Downloading the file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/fab15a98-bd84-40a5-8485-695579c5d4a5
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/828780
Signature
Sigma detected: Suspicious Csc.exe Source File Folder
Uses powershell Test-Connection to delay payload execution;
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 461209 Sample: mixazed_20210808-075823 Startdate: 08/08/2021 Architecture: WINDOWS Score: 48 45 www.google.com 2->45 47 prda.aadg.msidentity.com 2->47 63 Sigma detected: Suspicious Csc.exe Source File Folder 2->63 10 mixazed_20210808-075823.exe 1 2->10         started        signatures3 process4 signatures5 65 Uses powershell Test-Connection to delay payload execution; 10->65 13 cmd.exe 1 10->13         started        16 cmd.exe 1 10->16         started        18 cmd.exe 1 10->18         started        20 4 other processes 10->20 process6 signatures7 67 Uses powershell Test-Connection to delay payload execution; 13->67 22 powershell.exe 19 13->22         started        25 powershell.exe 19 16->25         started        27 powershell.exe 16 18->27         started        29 powershell.exe 15 21 20->29         started        32 powershell.exe 16 20->32         started        34 powershell.exe 16 20->34         started        process8 dnsIp9 49 www.google.com 22->49 51 www.google.com 25->51 53 www.google.com 27->53 55 cdn.discordapp.com 162.159.134.233, 443, 49741 CLOUDFLARENETUS United States 29->55 43 C:\Users\user\AppData\...\yuudw50s.cmdline, UTF-8 29->43 dropped 36 csc.exe 3 29->36         started        57 www.google.com 32->57 59 192.168.2.1 unknown unknown 34->59 61 www.google.com 34->61 file10 process11 file12 41 C:\Users\user\AppData\Local\...\yuudw50s.dll, PE32 36->41 dropped 39 cvtres.exe 1 36->39         started        process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d693bdb8fc82b3385c47a02ef9ac465a2470c1f345a5f0b7dbd835c9c7b40115/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-08-08 11:07:04 UTC
AV detection:
7 of 28 (25.00%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0559341de926b16d11ab2ae2516720bad55f44a16d1cdfaf4a06437d54374612
16fcaf343d6c5ec3c546339a522c47b7e44f0684ff50a7acf49d8439e2956a93
74aa215106b93c168681fc004231c4aa17f655c2fbd2a1eaccc041fb59f6b901
8424b5a86327251f934d4e4526de3d48b942c0953a866f84de2d7bb19a5fbc04
aa218adce0cc32486a75b6e5a2669c8b82afac444485f3d44bb168482276ad4e
dc12d4cb1e8224bd26571c7ce1c557740851ac248f56a5e449494e55c0edd722
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210808-q7lyzq1ptn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Unpacked files
SH256 hash:
d693bdb8fc82b3385c47a02ef9ac465a2470c1f345a5f0b7dbd835c9c7b40115
MD5 hash:
dfe4e4a9d0d02a17fd575b94291dfcfa
SHA1 hash:
4a8a44719272b2bd5b067f6b3439bb23f7ec15c6
Link:
https://www.unpac.me/results/3a04fd5f-db2b-4b8a-86cf-0e983ff84312/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d693bdb8fc82b3385c47a02ef9ac465a2470c1f345a5f0b7dbd835c9c7b40115

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
GCleaner
Cape
Cape
https://www.capesandbox.com/analysis/177236/

Comments