MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee8d431ff260c5d729ffecc6579b32262846dd598d9f9ef32bbe6527304c4bce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	ee8d431ff260c5d729ffecc6579b32262846dd598d9f9ef32bbe6527304c4bce
SHA3-384 hash:	00588bfcba816c15fa44c1a808f8e1e04083b279ce07cebfa259638bb93738b623b1d3471a681767acdd887361176394
SHA1 hash:	8bc7fefc5e89a54e5d280046082e975123e58f5d
MD5 hash:	434dddc176b0af840d2a2f53c8b8136a
humanhash:	salami-ceiling-muppet-cup
File name:	extract-1633590973.340585-HTTP-FxbP4DpEZShB8PfQ4__3.exe
Download:	download sample
File size:	10'240 bytes
First seen:	2021-10-08 13:46:37 UTC
Last seen:	2021-10-08 15:04:50 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep	192:ykbykYDjCkawKcjiDyJ3ZkHy8/V2p1jvv4DRnI9LMu:LykYbNs0ZkHdVGK1INJ
Threatray	10 similar samples on MalwareBazaar
TLSH	T17122D444A3F449B7DAFE073946933BC6CB79F9464F03DB5B208511236E473932190AAE
Reporter	c_APT_ure
Tags:	dll md5:ff8c3736ac246c6ec8cb08a3cef7e0cc officialsw chickenkiller com RemcosRAT

c_APT_ure

embedded EXE from
https://bazaar.abuse.ch/sample/a954c9f0b3b82dbe4e313537c77b681d3996605d57b55b3f0623b92b96ef1556

Intelligence

File Origin

# of uploads :

# of downloads :

316

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/196178/

Detection(s):

SecuriteInfo.com.Trojan.InjectNET.32.9587.10471.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

67%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/61604bdab95458900cdf56b6/reports/1e450d90-ec08-47f3-b86d-4b6742f02691/overview

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ee8d431ff260c5d729ffecc6579b32262846dd598d9f9ef32bbe6527304c4bce/

Threat name:

ByteCode-MSIL.Trojan.InjectorX

Status:

Malicious

First seen:

2021-10-08 13:47:09 UTC

AV detection:

13 of 28 (46.43%)

Threat level:

5/5

Verdict:

unknown

1bad08344c9fc0bd9a86f706d34615c7e40b47cd3034a818c8cdd738ba9005fa

1e6131270a54d52eff9606baa7503abf3ba8b20f268f99dd2657f750532e9396

2efc586fdcf901734e2ba8ce15c18926114850dc3d08b202d2059d8f0537601c

4bf1e0d167fa92e2cf62e30e5b454277d85874628fdb7de79bcd368393c12bc6

765b31935d5eb35c1d7e2c9b8844f865c452839b8d9a0bcfbe34e0ec3e3f66e5

8b038ad84a4c75c08baee7fedcf154cc6e292d697e3c5abcf72b4c83a150318a

c991fe8c6d840624fbf7b46c88514ff6324fea56997929b0a81d97b0f6eb7f88

ef7c7195dbc2646a5f8f31a21fe6155d78329045f7a9d5fe8fd0fa23c02e48cb

fe4d94970553cd7601c6e0a9e6a246d885abba1479ebd1da4b80e53f83e7875b

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/211008-q3j8yseefq/

Behaviour

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

ee8d431ff260c5d729ffecc6579b32262846dd598d9f9ef32bbe6527304c4bce

MD5 hash:

434dddc176b0af840d2a2f53c8b8136a

SHA1 hash:

8bc7fefc5e89a54e5d280046082e975123e58f5d

Link:

https://www.unpac.me/results/e2e720ef-cea0-4355-86cd-d9f4e4f71fc2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/ee8d431ff260c5d729ffecc6579b32262846dd598d9f9ef32bbe6527304c4bce

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.