MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9f990b7f6c926b198f2ca401cef7857e67bae26f9d437adcf265101d059899c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9f990b7f6c926b198f2ca401cef7857e67bae26f9d437adcf265101d059899c
SHA3-384 hash: f8351bbc7dccc7f563029a00d4dd797245bf5f76d94b88b854d03c3781491bfa0dbfe68e4d412a0cda6fe4b7fb594925
SHA1 hash: 66434dc8476ea35ff637f893b749f171de04b787
MD5 hash: 94c8242137109d1f8c40571eb65e13c9
humanhash: pip-eighteen-ohio-charlie
File name:663b576708dccc8621bb21fa688fecd9
Download: download sample
File size:207'360 bytes
First seen:2020-11-17 11:42:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1c7ab0e4c183931415ff18e5405878d9 (2 x ZeuS)
ssdeep 3072:oZ1MZbzSx8vhDVgfq/LVWfQm0cXE9lr3Nh7JYoONRNGKtKTkAVVeYaiXp+G:o3ybex81X/L0fQQ09lr9vGNGOKQ+SC/
Threatray 6 similar samples on MalwareBazaar
TLSH 7D14236CFE89DC2CCB7AA2731210C7D844BFD74495909BDAC2DCC15AA93A9658C1DC0B
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.EncPk-ABF.23660.18941.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9f990b7f6c926b198f2ca401cef7857e67bae26f9d437adcf265101d059899c/
Threat name:
Win32.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 11:45:19 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
077c87d4fef3f9c93485d04bebcfc01bd976f76c93b165a8b02a35545aa41436
4c850cfff31192c9f8439e0b9e4127d0b419c9909d2c85e7e99a5bb0115db3c9
4e49f5147939257640ba4990f520c9dbe355c83b73d9deadfc8505c4a09f931d
94c9336a6e056520105481a9082e7e84c8a98a794a06b037c573bd9efc9df809
a9ecdf87c4aaaf8b3ff46a06471db127ccbc48eb0d340eb299416a66b7733e89
fb1d643119c585f25746425ae0c33537611cdfa3a20a1b832034f2346fe55eb6
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201117-ytr32w7hwx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
d9f990b7f6c926b198f2ca401cef7857e67bae26f9d437adcf265101d059899c
MD5 hash:
94c8242137109d1f8c40571eb65e13c9
SHA1 hash:
66434dc8476ea35ff637f893b749f171de04b787
Link:
https://www.unpac.me/results/eb7966bc-1136-4c19-97f4-93efa32791c4/
SH256 hash:
560fa8fe11206b98118e485f03b92c16c0065f03f114d5ce2cb9d3dc8cee466d
MD5 hash:
a34742fc0f420df59fa99b104e05b163
SHA1 hash:
324d254a370214d28719b46fb01b48e85230df2d
Link:
https://www.unpac.me/results/eb7966bc-1136-4c19-97f4-93efa32791c4/
SH256 hash:
640fdc1f640cc042ae53e175e77c9b3a3fd0a69a99e1f27befb54a2a500241c1
MD5 hash:
45d236a9fdd6718bdba9dff9d6dee77c
SHA1 hash:
bdf584d504f4b0d93cb5469dd6252da58398bd63
Link:
https://www.unpac.me/results/eb7966bc-1136-4c19-97f4-93efa32791c4/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments