MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df26199f73733eed535dfd04fd8697fea707c5fc5f4770ca898af419ad96b177. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df26199f73733eed535dfd04fd8697fea707c5fc5f4770ca898af419ad96b177
SHA3-384 hash: 08bb3c242846aafacc03c3bd4c5387e90ab8a2c9f9d031cb7f72b48b7461e85eddf05ed800e2b225b98858ffdc80fdbb
SHA1 hash: bbd6deda5fdb1b47afe3663073e3d32ea4a255a1
MD5 hash: 13b933ccb839a2ec8f0819c10ffd07e5
humanhash: paris-uncle-eight-beer
File name:SecuriteInfo.com.Trojan.GenericKD.35624799.30696.10723
Download: download sample
File size:1'148'241 bytes
First seen:2021-01-05 13:52:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b115667bdbe6c5de94f48d40f603fc14
ssdeep 24576:/UzOaqh/gd/EH3fZzhM/FieEKPISYbfHx9oQxVpD9:OqhsENhMtZPISYbJGQx39
Threatray 1 similar samples on MalwareBazaar
TLSH AC35BE4239A6C275D63185B025A8A2D6892EBD30BF1E8CD7F3C43E8D65759C33732A53
Reporter SecuriteInfoCom

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/110583/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.35624799.30696.10723.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Sending an HTTP POST request
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Launching a process
Creating a window
Creating a file
Running batch commands
Creating a process with a hidden window
Sending a custom TCP request
Searching for the window
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df26199f73733eed535dfd04fd8697fea707c5fc5f4770ca898af419ad96b177/
Threat name:
Win32.Adware.RedCap
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 07:48:00 UTC
AV detection:
32 of 46 (69.57%)
Threat level:
  1/5
Verdict:
malicious
Similar samples:
5837a7832672ac0677622937160294332e38522be0f65182e892a9dd4ea32483
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/210105-9v6j5ge8mj/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Executes dropped EXE
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
df26199f73733eed535dfd04fd8697fea707c5fc5f4770ca898af419ad96b177
MD5 hash:
13b933ccb839a2ec8f0819c10ffd07e5
SHA1 hash:
bbd6deda5fdb1b47afe3663073e3d32ea4a255a1
Link:
https://www.unpac.me/results/cdd44594-c43f-4733-9654-07aa290ef6a5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/df26199f73733eed535dfd04fd8697fea707c5fc5f4770ca898af419ad96b177

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Ping_Command_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an suspicious ping command execution in an executable
Reference:Internal Research
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe df26199f73733eed535dfd04fd8697fea707c5fc5f4770ca898af419ad96b177

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/110583/
  
URLhaus
https://urlhaus.abuse.ch/url/949373/
  
Delivery method
Distributed via web download

Comments