MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef9b7f99346ac5307323163c42c1c5d1e63143287677c551db77403165346d96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 5 File information Comments

SHA256 hash:	ef9b7f99346ac5307323163c42c1c5d1e63143287677c551db77403165346d96
SHA3-384 hash:	7af876ec2ed79bf578f361daa50731d7e3998f9b8bc44f7fd457bd032c6fdd8feea06e19e024ff23ac2246e973be4144
SHA1 hash:	4d4f93b2abcd8fff94cf594e665f14710827b61d
MD5 hash:	d72c9da389ab5392ff617909572cac4d
humanhash:	echo-victor-cold-lemon
File name:	d72c9da389ab5392ff617909572cac4d.exe
Download:	download sample
File size:	587'760 bytes
First seen:	2021-03-19 07:40:42 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	caa5e6a2892587c2324418efee31c648 (9 x RedLineStealer, 1 x RemoteManipulator, 1 x RaccoonStealer)
ssdeep	12288:r7iLxBGNINmAOHP9e7hdBojydyVnXnJQI47M+:r7iNBEmcH1e7hdwydy1XnJQXQ+
Threatray	659 similar samples on MalwareBazaar
TLSH	71C4233ADBA4AC77ED17B0350464FB2A5311FD002A9C3772A14EB10BFE717721869A89
Reporter	abuse_ch
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

121

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

d72c9da389ab5392ff617909572cac4d.exe

Verdict:

No threats detected

Analysis date:

2021-03-19 07:47:26 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/77e33eef-9478-49fe-bc53-f642d863a7bd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/125595/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.45741523.25160.30218.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Sending a custom TCP request

Creating a file

Creating a file in the %AppData% directory

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/718b4a3d-b5d8-416c-9a16-8719a82e4ceb

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/645792

Signature

Creates HTML files with .exe extension (expired dropper behavior)

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

Sample or dropped binary is a compiled AutoHotkey binary

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ef9b7f99346ac5307323163c42c1c5d1e63143287677c551db77403165346d96/

Threat name:

Win64.Trojan.Ymacco

Status:

Malicious

First seen:

2021-02-16 14:49:59 UTC

AV detection:

21 of 28 (75.00%)

Threat level:

5/5

Verdict:

unknown

27c3f84dd3101c302afb523ee2c5b728c1fc34cfb8430c314d1f2df5ed79c28c

376c114e2072a289c3b38c6f96f41cbecdc7919142b1f6efe4f9f83e61810d5d

593f9422a79559ab792b98a272ebd5db883b8a85f34de6a6f05f1c900b221dc5

6738bf02f3fa9f972eb4a9e6b8a45bcf1bfc34d9b97e94d0bf37a398a6acd90d

6f7716d02c0d987e8816ced8c589bf4277f9d5f10c914f448d1bd9452d62c85b

8440d42f7d4b55f765b7634a73123c3f3b52eacf086765dfeb647889d4174574

a759e621f52b7cdfb3a747b20fcdc1235ef909125fbf50526dc4fbd72ffe0b1c

aea1d064fb75706dd261f1097f91574050216410ce840e9c7523c46aca53c5f9

e94e31beaf1c2a6c24f0973a621c8715faf91a18e8c7acdab8a832021c7ce5f5

+ 649 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/210319-e25s5wgaqn/

Behaviour

Suspicious behavior: GetForegroundWindowSpam

Enumerates physical storage devices

Legitimate hosting services abused for malware hosting/C2

Unpacked files

SH256 hash:

ef9b7f99346ac5307323163c42c1c5d1e63143287677c551db77403165346d96

MD5 hash:

d72c9da389ab5392ff617909572cac4d

SHA1 hash:

4d4f93b2abcd8fff94cf594e665f14710827b61d

Link:

https://www.unpac.me/results/943c29f5-b6fe-46af-9e40-520c25d83889/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.10

Link:

https://yomi.yoroi.company/submissions/ef9b7f99346ac5307323163c42c1c5d1e63143287677c551db77403165346d96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE).

Rule name:	INDICATOR_EXE_Packed_MPress Create hunting rule
Author:	ditekSHen
Description:	Detects executables built or packed with MPress PE compressor

Rule name:	INDICATOR_KB_CERT_0c15be4a15bb0903c901b1d6c265302f Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	INDICATOR_SUSPICIOUS_AHK_Downloader Create hunting rule
Author:	ditekSHen
Description:	Detects AutoHotKey binaries acting as second stage droppers

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/