MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4cf8390df0db1d1e0d703427544992d5e4622f44986350e5143ffdac25af20d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments 1

SHA256 hash:	e4cf8390df0db1d1e0d703427544992d5e4622f44986350e5143ffdac25af20d
SHA3-384 hash:	fbdecf7b9f8a1ff590516ea91e79cc730f5d87b809439509a0f03d8c792e4c6f430412b80cd2090c902be42835f65b16
SHA1 hash:	5b332fd2cfc379db4c32d888ec560b059932dac6
MD5 hash:	5338c6f1fd81bbdfbe0127dc6e2676c8
humanhash:	mike-whiskey-edward-friend
File name:	5338c6f1fd81bbdfbe0127dc6e2676c8
Download:	download sample
File size:	98'816 bytes
First seen:	2021-09-11 08:26:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a50e815adb2cfe3e58d388c791946db8 (2 x njrat, 2 x DCRat, 1 x Lucifer)
ssdeep	1536:7ogJhX7rgSs9a4g1p7ck0qgEdWcDVMB8vAmbhWBLVTDVadyDfDXx/Ac:EKhITZaVR0qDdWkVMB8vAmbKYyDfD
Threatray	69 similar samples on MalwareBazaar
TLSH	T119A312A29EF9E656DC6246F0A518DEC7BB04FFBA1D4F894B05961CFE9BF34818420107
Reporter	zbetcheckin
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

105

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

5338c6f1fd81bbdfbe0127dc6e2676c8

Verdict:

No threats detected

Analysis date:

2021-09-11 08:28:32 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/aaf70cc7-7434-4786-adce-31db05801a7f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/187032/

Detection(s):

Win.Malware.Killall-6913734-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Running batch commands

Creating a process with a hidden window

Launching a process

Launching cmd.exe command interpreter

Adding an access-denied ACE

Launching a service

Deleting a recently created file

Using the Windows Management Instrumentation requests

Searching for the window

Searching for many windows

Deleting volume shadow copies

Launching the process to interact with network services

Launching a tool to kill processes

Deleting of the original file

Forced shutdown of a browser

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9fb2f9c9-10f3-4ab0-9d72-e26b84487e80

Result

Threat name:

Unknown

Detection:

malicious

Classification:

rans.evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/849105

Signature

Deletes shadow drive data (may be related to ransomware)

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e4cf8390df0db1d1e0d703427544992d5e4622f44986350e5143ffdac25af20d/

Threat name:

Win64.Trojan.DelShad

Status:

Malicious

First seen:

2021-09-08 03:45:36 UTC

AV detection:

16 of 28 (57.14%)

Threat level:

5/5

Verdict:

malicious

0389ffef740d3bd365f2b699ac006b478a5346a1dc2383e10fd5152771641c0b

26b406b6452014369ea84da84be77531d4ad23ac6587996f6f5c8febd860ee9f

5f2846d5daa6e5781427feb62144502ff1522b8250eadbfb7aa3602d04eac1fb

6da210965cd769856bbcb8bb501abf25c832f0f6a70e73240436629ce6362fa9

767e8cdbeeb723d9a79665ef465e3ceca2595d773a04a7c900d550ad780ee1ff

88c642b1fa43b77487f3916dd95ac236189971475c3289c745dc45a739e6453f

9cc0cf19e63fbf43ed381c94967a1c52a606452657cc05c17b27a1a07e2c5607

aa46ec291334b68e6c96fed8f2b88ce521dd87ff7535a5465537e7d2c36d1539

+ 59 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

9/10

Tags:

discovery evasion ransomware upx

Link:

https://tria.ge/reports/210911-kceynabbf6/

Behaviour

Discovers systems in the same network

Interacts with shadow copies

Kills process with taskkill

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Launches sc.exe

Modifies file permissions

Modifies service settings

Stops running service(s)

Deletes shadow copies

Unpacked files

SH256 hash:

e4cf8390df0db1d1e0d703427544992d5e4622f44986350e5143ffdac25af20d

MD5 hash:

5338c6f1fd81bbdfbe0127dc6e2676c8

SHA1 hash:

5b332fd2cfc379db4c32d888ec560b059932dac6

Link:

https://www.unpac.me/results/be03b725-d9b3-4cd8-a8bd-92155ccd1278/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/e4cf8390df0d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e4cf8390df0db1d1e0d703427544992d5e4622f44986350e5143ffdac25af20d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Embedded_PE Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe e4cf8390df0db1d1e0d703427544992d5e4622f44986350e5143ffdac25af20d

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1509300/

Cape

https://www.capesandbox.com/analysis/187032/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-09-11 08:26:17 UTC

url : hxxp://91.243.44.5/Kill$.exe