MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e456ec922c26a29e159cfdaea9dd9bd03c34cbf5d3257fccecdbb155e574a287. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e456ec922c26a29e159cfdaea9dd9bd03c34cbf5d3257fccecdbb155e574a287
SHA3-384 hash: 97a073a855d47a3b7585ba376ab2b8e6a4ffb6f4a672fa7d226f25dfccc912308ec2f7afb4c7178dfffaaad97c6348b1
SHA1 hash: 4f9a9e4f0dd8e9930d68ff79ad61f7e2b3739448
MD5 hash: f7db18d6128ad9763e440a3fe642a3c6
humanhash: wyoming-uncle-kitten-island
File name:test.exe
Download: download sample
File size:2'185'505 bytes
First seen:2021-05-24 14:21:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f4cf09dd5265ea802d83e943c2137765 (1 x QuasarRAT)
ssdeep 49152:u4+Tw8Ga5b6KRXkRmKvvV+bxcoqbRjpQE9kZcaRB:FX8GaeTvvV4xq9LnM
Threatray 11 similar samples on MalwareBazaar
TLSH E2A523496A1009EDF5F6413A8C02C12EE7737C6213B4D68B06E85967BF636617D3EFA0
Reporter Anonymous

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
test.exe
Verdict:
No threats detected
Analysis date:
2021-05-24 14:25:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/58b814b5-de27-4166-8361-f74f9b717414

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/161510/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
5 / 100
Link:
https://www.joesandbox.com/analysis/790436
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e456ec922c26a29e159cfdaea9dd9bd03c34cbf5d3257fccecdbb155e574a287/
Threat name:
Win64.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-05-24 14:22:11 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
138ed0d540b78da8f5dd520d84efc55e924a321dfc05312d512065f4a7d8ac1c
16a9bd04b1d92c0853acb7a0e7e9d3a047e9a55829245be9aa23b5088a072f4a
2ce89d5d8b680b72063d34470ff0e9b77075e25056bd0a50899c06e193fe2452
962fb10511fe292bbe0d71ff2d2834e6313a69709a8c80afb4b879d00b1d9918
9a171356b47003ea038e123e7fd636d491b48fdef992155d422ce46f8e8d3518
a7e1e2acc336f93d4997f682420424f52aa81f63ffe4a22c715fe476c627b9f4
c9ac9582c979029bb83b4b14b735c764ef94bdac3dd59ebe5963d2ca0ad5f897
da23dacc9e28905b0cc9f0724e182e8963525162b177d023c0c859e8fee09d43
fb7e3d141ff3851b74b24c265fd94db17a9571bb6686fe2f47bd12d053d88309
fed02796762f63978094ad4b21b1952948cea78281abb55ba58bbb7886531ea1
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/210524-47ldg772mn/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e456ec922c26a29e159cfdaea9dd9bd03c34cbf5d3257fccecdbb155e574a287

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_File_pyinstaller
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Description:Detect PE file produced by pyinstaller
Reference:https://isc.sans.edu/diary/21057
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe e456ec922c26a29e159cfdaea9dd9bd03c34cbf5d3257fccecdbb155e574a287

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/161510/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-24 15:38:38 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009] Anti-Behavioral Analysis::Virtual Machine Detection
1) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
2) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
3) [C0032.005] Data Micro-objective::Adler::Checksum
4) [C0060] Data Micro-objective::Compression Library
5) [C0026.002] Data Micro-objective::XOR::Encode Data
7) [C0046] File System Micro-objective::Create Directory
8) [C0048] File System Micro-objective::Delete Directory
9) [C0047] File System Micro-objective::Delete File
10) [C0051] File System Micro-objective::Read File
11) [C0052] File System Micro-objective::Writes File
12) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
13) [C0040] Process Micro-objective::Allocate Thread Local Storage
14) [C0017] Process Micro-objective::Create Process
15) [C0041] Process Micro-objective::Set Thread Local Storage Value
16) [C0018] Process Micro-objective::Terminate Process