MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e35b9feacfba1df802f9ed242775361f4317c22782f4e9e2dddd095577a72487. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TA505


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e35b9feacfba1df802f9ed242775361f4317c22782f4e9e2dddd095577a72487
SHA3-384 hash: e8d17330cbc8c3c60312562413fe67117ee3310dca5d05f705d8beb5332be2f3d70dd0f314f60efde3fb4a07b7ce780f
SHA1 hash: acf4e3c3fd1772c7d4ebec32b38d018cce4e9707
MD5 hash: 83b02e12a48b092f91788d7c253dd1c2
humanhash: high-floor-social-dakota
File name:libOmio.dll
Download: download sample
Signature TA505
Create hunting rule
File size:285'696 bytes
First seen:2020-06-12 15:52:06 UTC
Last seen:2020-06-12 16:32:12 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash f33ee3905eb3a4b808a32d5bf026379e (1 x TA505)
ssdeep 6144:i70Czl/0AfWgDUAWIGFreFFhNarCQ13ER7CCyHl7bEi5w:xQWgDUAWheFf77t2Rx
Threatray 88 similar samples on MalwareBazaar
TLSH C454F23099818BACF59805B917EB6F8CA1353DB03725D1A30F6502E5AC78E5DBD8B31E
Reporter James_inthe_box
Tags:dll TA505

Intelligence

File Origin
# of uploads :
2
# of downloads :
821
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/10078/
Detection(s):
SecuriteInfo.com.Variant.Ursu.897029.8383.7289.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.GraceWire
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 12:09:31 UTC
File Type:
PE (Dll)
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4nnz72wpxio7qaxz5usco5jwd5brpqrhql2otyw53uevk55hesdq._file
Verdict:
malicious
Similar samples:
0d4f2d354fd2aca85b2719d749eb88c1f444309ae27f3824f0faac8bdbfa4249
TA505
4a48467546d08abe1332b9b4684e07156b25681bf808744ab6500a4ff0d28c7b
TA505
508d78074875474e25946867b4ad45d4571018cd8026b73730e3cdc632c6c986
TA505
5b0334f87cdd0689007412142c2d22e362f252df22eb5ea5b4898710b59e1bb0
TA505
674cac26b5ee006a476669c6857e24a8187ef94945d521c8bbe9069ec74494ba
TA505
9ad7ce27ce7da3c4b2639771869b20b78fff34f32dab3355c2be2980e708ab07
TA505
9dd13e02121ff016438f0540d169df51ac44527eabc4116143d6e0b569dc1f99
TA505
acd7214a4c37bbfd55ea244080769e4c0daf59edb47b3abcddcf5874cdb3054f
TA505
c8e25ee1363bbd595f4783537fc1028f427a8ed0d7a1940dab3bd67abfc53f85
TA505
ce0f73cf6d1f1ed4fd3e15c7fd70a6581215a93e6a45cdf2e64af68c4c1993af
TA505
+ 78 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-glsffdfkya/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_get2_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/10078/

Comments