MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd1dc97c210d7ed5cfe8c72bd8dd28bb080dcf1444d9770fdd7c5c436de345e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd1dc97c210d7ed5cfe8c72bd8dd28bb080dcf1444d9770fdd7c5c436de345e5
SHA3-384 hash: 48a5cc783b39fb2d9ccbf34836bccd9fd7229114c75a8b9f72400e3f6e64fe447fe271359ec0b1589428cc1b0fd2e11e
SHA1 hash: 5cd24b38d2de530b543a820fb0a0131d7533a1af
MD5 hash: 9114e653530dcf312e951e7c15b988f3
humanhash: west-high-eight-mockingbird
File name:9114e653530dcf312e951e7c15b988f3
Download: download sample
File size:542'208 bytes
First seen:2021-08-13 18:26:29 UTC
Last seen:2021-08-13 18:50:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d1727cc76cb77410e59de4eb81f68a0b (12 x RaccoonStealer, 3 x RedLineStealer, 1 x Bandook)
ssdeep 12288:H30ucVd+eJ0nAtdgYEvMZVRYj76TCSEsh6ls8q28bL4VjJuOdnqi:N++csAty3kZUjeTCn/lslpbL4VBnqi
Threatray 18 similar samples on MalwareBazaar
TLSH T13BB401D5BA93E87EC099C0F10860CAB05BB2B8556464094F66993F9F39333D386FD2D6
dhash icon 4839b2b0e8c38890 (105 x RaccoonStealer, 38 x Smoke Loader, 33 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9114e653530dcf312e951e7c15b988f3
Verdict:
Malicious activity
Analysis date:
2021-08-13 18:28:24 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a62a03ac-0db9-4a0f-a3e0-00ec49bbb55b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/179073/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.11991.24080.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Blocking the Windows Defender launch
Rewriting of the hard drive's master boot record
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Pitou
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/831843b7-1246-46e8-8c13-2c7bcd81b455
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/832624
Signature
Contains functionality to infect the boot sector
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd1dc97c210d7ed5cfe8c72bd8dd28bb080dcf1444d9770fdd7c5c436de345e5/
Threat name:
Win32.Ransomware.Aicat
Create hunting rule
Status:
Malicious
First seen:
2021-08-13 18:27:05 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
281de330768f7e2231f3984b2fbac04bf9f7f2b2d4fb3c2f91d6ba2eab8d546c
66cebd1b0a87df2ddcd805723d15e8094c23dfe1d4a2108348579995a102c994
6feed7d5f7d9776c69963076fdb46de01b8ff9253a84b9e086e0beefc85a181d
7432d519a0a8042c26d8fa9637c9c07de4c33cde886feb1fbc063f1a5d828ed4
b7de56f8c1d25037dbded37355d0cd8219f68d38683913de1e000c2c50159143
ce1c2e089ab14ef543b6604bd4fd82213708b89372fd63d414ff6e694ddce4ad
dbb1ffb8a8b13b389fd8aff976808226333bc23d8aafc33111b88206f498fcea
+ 8 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
bootkit persistence
Link:
https://tria.ge/reports/210813-bk4cp38wda/
Behaviour
Suspicious use of AdjustPrivilegeToken
Writes to the Master Boot Record (MBR)
Unpacked files
SH256 hash:
40952c341d05273c0c581ee26718e131666f4def5ae9839c686ba5e6bd57ba7d
MD5 hash:
7a37018d3bb55b535803345f8dfc14db
SHA1 hash:
008e8644fec789c07acea71ebd5a31742a3fa42c
Detections:
win_pitou_auto
Create hunting rule
Link:
https://www.unpac.me/results/5f35dbc9-b52d-43ff-90d0-c02c5b243ec6/
Parent samples :
829f2d1a30848cec9b28b47782537ad64a3770d6b22359c0d3f5257215b49105
ce1c2e089ab14ef543b6604bd4fd82213708b89372fd63d414ff6e694ddce4ad
66cebd1b0a87df2ddcd805723d15e8094c23dfe1d4a2108348579995a102c994
7432d519a0a8042c26d8fa9637c9c07de4c33cde886feb1fbc063f1a5d828ed4
dd1dc97c210d7ed5cfe8c72bd8dd28bb080dcf1444d9770fdd7c5c436de345e5
b6b28602888cb4f4335d3e02a0a91cd945a64f1c5cd6372cf70aad05dc5c0d30
440de5c3ce1c9cf276516354babcae98f726b2f6a16d747f5ca2154b0e450410
d7eecb951a6b4439f8b71fc6b6d71b1892ee0c3ca26ae2e3fda22960515d8963
4004d8d0d2163211efed5e32a184c3842f643f02b29c5b619bb4ef97a8afc3e6
SH256 hash:
dd1dc97c210d7ed5cfe8c72bd8dd28bb080dcf1444d9770fdd7c5c436de345e5
MD5 hash:
9114e653530dcf312e951e7c15b988f3
SHA1 hash:
5cd24b38d2de530b543a820fb0a0131d7533a1af
Link:
https://www.unpac.me/results/5f35dbc9-b52d-43ff-90d0-c02c5b243ec6/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/dd1dc97c210d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd1dc97c210d7ed5cfe8c72bd8dd28bb080dcf1444d9770fdd7c5c436de345e5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe dd1dc97c210d7ed5cfe8c72bd8dd28bb080dcf1444d9770fdd7c5c436de345e5

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1531397/
Cape
Cape
https://www.capesandbox.com/analysis/179073/

Comments


Avatar
zbet commented on 2021-08-13 18:26:30 UTC

url : hxxp://88.80.145.9/index.php