MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ec694d5b05f7aa43e3e701e40686039a38d6827e5e944ba73de07f31da18d608. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
YoungLotus
Vendor detections: 8
| SHA256 hash: | ec694d5b05f7aa43e3e701e40686039a38d6827e5e944ba73de07f31da18d608 |
|---|---|
| SHA3-384 hash: | f3d0245c6974a7603bf427d1f31c51dc628f890509a1b5679ca5c010c969a1f569baac9401a839f562d4016ba9f0f4c8 |
| SHA1 hash: | 5c2c9e20f5607534128265bbbd03794be01e9e1d |
| MD5 hash: | 61a6445842bfd501f8e8c63a18e899cd |
| humanhash: | mexico-wisconsin-don-mobile |
| File name: | 马尼拉公厕碎尸女教师！只因不愿做校长情人.cmd |
| Download: | download sample |
| Signature | YoungLotus |
| File size: | 1'835'008 bytes |
| First seen: | 2021-09-22 00:32:52 UTC |
| Last seen: | 2021-09-22 02:01:03 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | e2afc946bb1a7942e18b4d1a8f444ebd (9 x YoungLotus, 2 x Nitol) |
| ssdeep | 49152:ynIAkIbQy7h9Xk2rWL7jhzxpIa6Ed6kd8:QkIbBpsjzl6Ene |
| Threatray | 31 similar samples on MalwareBazaar |
| TLSH | T114859D11AECC4CB2E2A73230455E777951ADF8606B3086C76394779DEC34BC16A3A39B |
| File icon (PE): |  |
| dhash icon | 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer) |
| Reporter |  ActorExpose |
| Tags: | exe younglotus |
Intelligence
File Origin
# of uploads :
2
# of downloads :
212
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
bank.spyw.evad
Score:
60 / 100
Signature
Checks if browser processes are running
Contains functionality to capture and log keystrokes
Malicious sample detected (through community Yara rule)
Tries to evade analysis by execution special instruction which cause usermode exception
Behaviour
Behavior Graph:
Threat name:
Win32.Backdoor.Farfli
Status:
Malicious
First seen:
2021-09-22 00:33:05 UTC
AV detection:
20 of 45 (44.44%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 21 additional samples on MalwareBazaar
Result
Malware family:
chinese_generic_botnet
Score:
10/10
Tags:
family:chinese_generic_botnet botnet persistence
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Drops file in Program Files directory
Adds Run key to start application
Enumerates connected drives
Chinese Botnet Payload
Generic Chinese Botnet
Unpacked files
SH256 hash:
b7c9285cdaaef8c8f479f8e8d2f318d4924f14dddd6ccda58b73cedcddaa6404
MD5 hash:
7bbc49f3d0f8a10e94efa4dd1c84cf94
SHA1 hash:
66cdabeb120a61f8fe96ca9b6b5a5a3927edde9e
Detections:
win_younglotus_auto
SH256 hash:
ec694d5b05f7aa43e3e701e40686039a38d6827e5e944ba73de07f31da18d608
MD5 hash:
61a6445842bfd501f8e8c63a18e899cd
SHA1 hash:
5c2c9e20f5607534128265bbbd03794be01e9e1d
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.