MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0005227c3c8d598d73108b95758f2a64cc92305614bb111d5e9526a1201ed81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	e0005227c3c8d598d73108b95758f2a64cc92305614bb111d5e9526a1201ed81
SHA3-384 hash:	e04d6ef6643eaa4acd679a807f9bc03d64a505798a4f3b63e254049c57d064edb2daf0f6c46bf042cc2b4973b86b6572
SHA1 hash:	79d68e67e2aea53f9d3c5a0ae58262cd28bba0f0
MD5 hash:	c90d343e960c2a7773097bfd4075f2f5
humanhash:	stairway-aspen-cold-lithium
File name:	UnderWars.rar
Download:	download sample
File size:	78'054'976 bytes
First seen:	2024-04-21 15:02:43 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	1572864:2g6LBYKH0aXsYQi2Jrydy7gJnsI0SNcucgzxTMWIyXYQ9:2juWcR3rEy8JnsqN0QMWV
TLSH	T1F00833ED1FE1BD02F4EC3FFE6A2A79B7AB2284485DC04C52326816C66821D475E0F579
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	NDA0E
Tags:	electron pw-beta rar under-wars.com UnderWars

NDA0E

Distributed via: under-wars.com > https://under-wars.com/downloads/UnderWars.rar

C2: 98.66.170.171:443

Intelligence

File Origin

# of uploads :

# of downloads :

109

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	UnderWars.exe
File size:	78'054'804 bytes
SHA256 hash:	7ab82c1ffa37f1538594cc5ad56f6dd047baf2c30bfcce614f1ad28b56196d35
MD5 hash:	07459ba6359ffa670886e62d763f6614
MIME type:	application/x-dosexec

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/66252ab2d2fc149e411692be/reports/2bf8ec5b-ccdb-4e7e-b4c5-d6332a68b315/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e0005227c3c8d598d73108b95758f2a64cc92305614bb111d5e9526a1201ed81

Result

Verdict:

MALICIOUS

Score:

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/240421-wlf3vsgd84/

Behaviour

Checks processor information in registry

Enumerates processes with tasklist

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks installed software on the system

Looks up external IP address via web service

Drops startup file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.