MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6c39d7d9be421b66517d195180f7156c52c3fadba440d5d3d26ff6b1d45aa1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6c39d7d9be421b66517d195180f7156c52c3fadba440d5d3d26ff6b1d45aa1a
SHA3-384 hash: 7a1c91b752e6643513d69b91c44634b9c273d48b70f75fef1821099a65a0af0c838d7f5a7617356df6de8ec14a2c68bb
SHA1 hash: 8c363d01e47d6dffd66044b1a34a78c5a1aac59c
MD5 hash: 346b3c83128f1918b162694eec15963d
humanhash: butter-apart-stream-island
File name:d6c39d7d9be421b66517d195180f7156c52c3fadba440d5d3d26ff6b1d45aa1a.bin
Download: download sample
File size:25'518'389 bytes
First seen:2021-12-31 00:50:35 UTC
Last seen:2021-12-31 07:04:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5324ac1e1bceff69ec8d4435c50bfe0e
ssdeep 393216:7YsI/ECt9c5hlER6GRGsUgu7QiDhDnwrJBjwPoc2O5rVWeRMRFJzFcguYtN3ZW7n:8sXQEhk6YGh9esoEWMqZtN3+uaA
Threatray 54 similar samples on MalwareBazaar
TLSH T14A4733579B910E8EE45D0332E4A9DC78D571F8241BB1E62B27683AE2438B5EC3C79713
File icon (PE):PE icon
dhash icon c6c2ccc4f4e0e0f8 (37 x PythonStealer, 21 x CrealStealer, 19 x Empyrean)
Reporter Arkbird_SOLG
Tags:exe Ransomware

Intelligence

File Origin
# of uploads :
2
# of downloads :
336
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://mega.nz/file/Yp8RXCoS#-0ibfHaU4xeLAMPprW0lNDpeaLQzcPJ77m4EfNr9LgI
Verdict:
Malicious activity
Analysis date:
2021-12-30 22:03:26 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/d8385738-c13a-4f9c-8110-4c67f6337edb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
DNS request
Sending a custom TCP request
Creating a file
Changing a file
Modifying an executable file
Creating a file in the Program Files directory
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Replacing files
Encrypting user's files
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/61ce53fdec6c6c14a9ff2ec7/reports/61894172-bc73-4761-9c65-0ac547f1d379/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/914193
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win64.Trojan.Tedy
Create hunting rule
Status:
Malicious
First seen:
2021-12-30 15:56:07 UTC
File Type:
PE+ (Exe)
Extracted files:
1632
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
04a31ae8a31bb4144d7392040442f4a38e8301cc550124cc47d012a0eba71bdd
053e7603d2776f39c17d74cd5a095d2fa4727ce019cb91274c135be4b9732358
089b3975338c69d1c8ae96cec13328459e8208c7cf9c88ce98896b90697c140b
1a9d8e0f73b132cec42a383b06fc86cc73e451a653ef93a693e6738321648539
1cb25d3cc571376d8ede87286d774b307c92df8371b7a483e53383ae33443784
3d0ca4604a0effdd7d12700991d223fc96ea02b49531fcea2e4e4d3db521e9b2
3f09f8df1e94e9588e4f9584e4d97eae73bf6e7375c92751cbb1f7e9647242d3
774c3c82a6ba75819070cca4d14f0df9329ebfe5b4dbb2e61423f95281ae7e6d
cd55506ba70b766f436a1dd02dcedb800dc5eeab058de438a2da134e4ec9d466
cdd0d34714297037b5be052585421821a6c30d48866394ea0bb8c1a7f29a9195
+ 44 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
pyinstaller ransomware spyware stealer
Link:
https://tria.ge/reports/211231-a7h9fsehhm/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Drops desktop.ini file(s)
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Drops file in Drivers directory
Modifies extensions of user files
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d6c39d7d9be421b66517d195180f7156c52c3fadba440d5d3d26ff6b1d45aa1a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/fbgwls245/status/1476572295502372865

Comments