MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9bbcfb5d9f42ef0dd75eb435e78d5226087679593893e0c08977694e720cd7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dharma


Vendor detections: 17


Intelligence 17 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9bbcfb5d9f42ef0dd75eb435e78d5226087679593893e0c08977694e720cd7a
SHA3-384 hash: 3d9a81622129d2ad2e4454dedb168429d9110d9b53ce7769f8648a14be8a459defc68bcc6b2ab35f134be52461732cf4
SHA1 hash: fef4e9bc0d20f52423e02ec0bc6a52ea36af97a5
MD5 hash: 8ee82932641f3f527110b0f8ce6b11ce
humanhash: tennessee-speaker-eleven-august
File name:bacon_2018-04-13_22-27.bin
Download: download sample
Signature Dharma
Create hunting rule
File size:147'456 bytes
First seen:2023-03-27 18:07:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e2923526c1025bf81115648776bcac8d (1 x Dharma, 1 x GandCrab)
ssdeep 3072:tjQgjwASUryVehsZnsTQqLSA/thZhUzcB4r50W23HnBB:R9iV3nspZ/t/6KWmH
Threatray 75 similar samples on MalwareBazaar
TLSH T1B8E3BE0C33958037E6A20DB44CA37BA2A96BB8776970505B3D5431781AF4EC07D79BBB
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
dhash icon 58706dce96c9ec84 (1 x Dharma, 1 x GandCrab)
Reporter petikvx
Tags:Dharma Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
670
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bacon_2018-04-13_22-27.7z
Verdict:
Malicious activity
Analysis date:
2023-03-27 15:46:36 UTC
Tags:
ransomware
Link:
https://app.any.run/tasks/406293e4-3f36-4e07-83d1-e06589225843

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Dharma
Create hunting rule
Link:
https://www.capesandbox.com/analysis/377951/
Detection(s):
Win.Packer.Crypter-6539596-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the system32 directory
Creating a file
Launching cmd.exe command interpreter
Creating a process with a hidden window
Searching for synchronization primitives
Enabling the 'hidden' option for recently created files
Creating a file in the Program Files directory
Creating a file in the Program Files subdirectories
Modifying an executable file
Changing a file
Replacing executable files
Moving a file to the Program Files subdirectory
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Deleting volume shadow copies
Enabling autorun by creating a file
Infecting executable files
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/75248/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionGetTickCount
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypter crysis gandcrab grandcrab greyware mokes packed ransomx threat trik zbot
Link:
https://www.filescan.io/uploads/6421db8380ca4ca1ff59a8b3/reports/c93f6687-85d7-40d3-9ee4-c318dc640681/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/e9bbcfb5d9f42ef0dd75eb435e78d5226087679593893e0c08977694e720cd7a
Malware family:
Matrix
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e707bb7d-cb55-4dc1-8d48-18adc5008ecd
Result
Threat name:
Crysis
Create hunting rule
Detection:
malicious
Classification:
rans.spre.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1202897
Signature
Antivirus / Scanner detection for submitted sample
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious names
Creates files in the recycle bin to hide itself
Creates multiple autostart registry keys
Deletes shadow drive data (may be related to ransomware)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files to the startup folder
Found potential ransomware demand text
Infects executable files (exe, dll, sys, html)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May disable shadow drive data (uses vssadmin)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes many files with high entropy
Yara detected Crysis Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 835802 Sample: bacon_2018-04-13_22-27.bin.exe Startdate: 27/03/2023 Architecture: WINDOWS Score: 100 50 Malicious sample detected (through community Yara rule) 2->50 52 Antivirus / Scanner detection for submitted sample 2->52 54 Multi AV Scanner detection for dropped file 2->54 56 8 other signatures 2->56 7 bacon_2018-04-13_22-27.bin.exe 3 503 2->7         started        11 bacon_2018-04-13_22-27.bin.exe 2->11         started        13 mshta.exe 12 2->13         started        15 2 other processes 2->15 process3 file4 38 C:\Windows\...\bacon_2018-04-13_22-27.bin.exe, PE32 7->38 dropped 40 C:\Users\...\bacon_2018-04-13_22-27.bin.exe, PE32 7->40 dropped 42 C:\...\bacon_2018-04-13_22-27.bin.exe, PE32 7->42 dropped 44 33 other files (32 malicious) 7->44 dropped 58 Creates files in the recycle bin to hide itself 7->58 60 Creates autostart registry keys with suspicious names 7->60 62 Creates multiple autostart registry keys 7->62 70 4 other signatures 7->70 17 cmd.exe 1 7->17         started        20 cmd.exe 7->20         started        22 mshta.exe 15 7->22         started        24 mshta.exe 12 7->24         started        64 Multi AV Scanner detection for dropped file 11->64 66 Detected unpacking (changes PE section rights) 11->66 68 Detected unpacking (overwrites its own PE header) 11->68 signatures5 process6 signatures7 46 May disable shadow drive data (uses vssadmin) 17->46 48 Deletes shadow drive data (may be related to ransomware) 17->48 26 conhost.exe 17->26         started        28 vssadmin.exe 1 17->28         started        30 mode.com 1 17->30         started        32 conhost.exe 20->32         started        34 vssadmin.exe 1 20->34         started        36 mode.com 1 20->36         started        process8
Detection:
dharma
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e9bbcfb5d9f42ef0dd75eb435e78d5226087679593893e0c08977694e720cd7a/
Threat name:
Win32.Ransomware.GandCrab
Create hunting rule
Status:
Malicious
First seen:
2018-04-17 15:01:03 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
33 of 37 (89.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5g547noz6qxpbxlv5nbv46gvejqioz4vsoet4dais53jjzzazv5a._file
Verdict:
malicious
Similar samples:
084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919
Dharma
1398be5280bdfc67179822e32d2d39e3e36afac05f88f3267cc7a1a63a3bdb68
Dharma
227d13f9a142cc6f050b7761e6c6e1bae712c4440730ec71c84e5acb274555e3
Dharma
2f2e75affe9217c7211043936678fb1777e2db4a8f1986b8805ddb1e84e9e99b
Dharma
42732ad450696b816913753fa9f53b52ac10922a1df1b5795693db77d532ffbc
Dharma
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686
Dharma
65ac9daf3070161ac996fb8946632599547f1c9450d7dcd0f8dc1c85b4e8b3b7
Dharma
7570a7a6830ade05dcf862d5862f12f12445dbd3c0ad7433d90872849e11c267
Dharma
9a4e6b6a25332f21e4e15bd5c67ea1613db78bf02fa3cef2eba47f27723f8d58
Dharma
9e5f370201251e8dc138678f8e0d4f0bdd75e1353edcc77d41c8401621c2c671
Dharma
+ 65 additional samples on MalwareBazaar
Result
Malware family:
dharma
Create hunting rule
Score:
  10/10
Tags:
family:dharma persistence ransomware spyware stealer
Link:
https://tria.ge/reports/230327-wqv3ksef65/
Behaviour
Checks SCSI registry key(s)
Interacts with shadow copies
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookAW
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in System32 directory
Adds Run key to start application
Drops desktop.ini file(s)
Enumerates connected drives
Checks computer location settings
Drops startup file
Reads user/profile data of web browsers
Modifies Installed Components in the registry
Modifies extensions of user files
Deletes shadow copies
Dharma
Unpacked files
SH256 hash:
62d3e2a2322bd550ac635ae1196c3dbc98663013b8be558a0f6c8a962bbf7342
MD5 hash:
f70d2f9bde1db8f25eef806dd17e7bdb
SHA1 hash:
0b15a2e84df650dddf3fdd9ccdc13bdc64b3e3a4
Detections:
win_dharma_auto
Create hunting rule
Link:
https://www.unpac.me/results/0d61f919-fa95-4388-9440-360759d9132d/
SH256 hash:
5607fcd69578da06127f94c8530ce6b632bba4f0fa09c08903e1dfccc5d82d09
MD5 hash:
f09c3c9f110ec46fcfb3051315ae86d8
SHA1 hash:
8e4fd042bbbada0bf1a951845f2e8c496e27a2ec
Link:
https://www.unpac.me/results/0d61f919-fa95-4388-9440-360759d9132d/
SH256 hash:
e9bbcfb5d9f42ef0dd75eb435e78d5226087679593893e0c08977694e720cd7a
MD5 hash:
8ee82932641f3f527110b0f8ce6b11ce
SHA1 hash:
fef4e9bc0d20f52423e02ec0bc6a52ea36af97a5
Link:
https://www.unpac.me/results/0d61f919-fa95-4388-9440-360759d9132d/
Malware family:
Dharma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e9bbcfb5d9f4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e9bbcfb5d9f42ef0dd75eb435e78d5226087679593893e0c08977694e720cd7a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/377951/

Comments