MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f080bf1c00fb050cc2a92fb17c08cd22d427782c6f47c532a2462ce3325905f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f080bf1c00fb050cc2a92fb17c08cd22d427782c6f47c532a2462ce3325905f0
SHA3-384 hash: c35786701ef0c940ee5b1f037ffb634208b926f9b936d745d4f821c35266091df7a506f7b69dcc12b42751335d6961d7
SHA1 hash: 3de193ff5b14466e9133924a0cbbd47e93e8e4b5
MD5 hash: f4e6aac90793c1830e47adfd445254ae
humanhash: carolina-jupiter-leopard-quebec
File name:360测速.exe
Download: download sample
File size:3'573'760 bytes
First seen:2022-12-31 19:06:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 332f7ce65ead0adfb3d35147033aabe9 (81 x XRed, 18 x SnakeKeylogger, 7 x DarkComet)
ssdeep 49152:onsHyjtk2MYC5GDeSVN8XUBKGA9oD+xEBJQZcaDdVCQo0YpEHkMqZ+x8gU/:onsmtk2aVSQXUG9oDnJQWaDdOpCdqRd/
Threatray 130 similar samples on MalwareBazaar
TLSH T18CF51233B2D18433D1325A3D9C6B93A9582ABF512D38794E7BF92E4C4F3D68128652D3
TrID 87.6% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
3.5% (.EXE) UPX compressed Win32 Executable (27066/9/6)
3.5% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
1.8% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
dhash icon b6f09e1761e633b2
Reporter atomiczsec
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
360测速.exe
Verdict:
Suspicious activity
Analysis date:
2022-12-31 19:07:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/24f69717-1e28-467a-9040-243ad07d6e78

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.D1s1g-5
Create hunting rule

PUA.Win.Packer.D1s1g-1
Create hunting rule

PUA.Win.Packer.D1s1g-2
Create hunting rule

Win.Worm.Sohanad-7505804-0
Create hunting rule

Win.Trojan.Emotet-9850453-0
Create hunting rule

Win.Trojan.Generic-9936029-0
Create hunting rule

Win.Malware.Delf-6899401-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
80%
Tags:
autorun cmd.exe darkkomet evasive fingerprint greyware hacktool keylogger macros macros-on-close macros-on-open packed shell32.dll virus
Link:
https://www.filescan.io/uploads/63b088570e926711fd7607c0/reports/570b87d3-da63-4008-9935-c33c75db6bec/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/854aec69-a71a-4c96-bb16-e27ad38d3c55
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1143654
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)
Drops PE files to the document folder of the user
Found stalling execution ending in API Sleep call
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 776384 Sample: 360#U6d4b#U901f.exe Startdate: 31/12/2022 Architecture: WINDOWS Score: 100 86 Multi AV Scanner detection for domain / URL 2->86 88 Antivirus detection for URL or domain 2->88 90 Antivirus detection for dropped file 2->90 92 8 other signatures 2->92 7 360#U6d4b#U901f.exe 1 6 2->7         started        10 EXCEL.EXE 23 19 2->10         started        13 Synaptics.exe 2->13         started        process3 dnsIp4 30 C:\Users\user\...\._cache_360#U6d4b#U901f.exe, PE32 7->30 dropped 32 C:\ProgramData\Synaptics\Synaptics.exe, PE32 7->32 dropped 34 C:\ProgramData\Synaptics\RCX35C5.tmp, PE32 7->34 dropped 36 C:\...\Synaptics.exe:Zone.Identifier, ASCII 7->36 dropped 15 ._cache_360#U6d4b#U901f.exe 32 7->15         started        19 Synaptics.exe 16 7->19         started        72 52.109.32.24 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 10->72 74 8.8.8.8 GOOGLEUS United States 10->74 file5 process6 dnsIp7 46 C:\Users\user\AppData\Local\...46etSpeed.dll, PE32 15->46 dropped 48 C:\Users\user\AppData\...\360perfoptm.dll, PE32 15->48 dropped 50 C:\Users\user\AppData\Local\...\360nettj.dll, PE32 15->50 dropped 54 6 other malicious files 15->54 dropped 76 Multi AV Scanner detection for dropped file 15->76 78 Found stalling execution ending in API Sleep call 15->78 22 360SpeedTest.exe 23 44 15->22         started        56 172.217.168.45 GOOGLEUS United States 19->56 58 172.217.168.46 GOOGLEUS United States 19->58 60 69.42.215.252 AWKNET-LLCUS United States 19->60 52 C:\Users\user\Documents\DVWHKMNFNN\~$cache1, PE32 19->52 dropped 80 Antivirus detection for dropped file 19->80 82 Drops PE files to the document folder of the user 19->82 84 Machine Learning detection for dropped file 19->84 26 WerFault.exe 9 19->26         started        28 WerFault.exe 19->28         started        file8 signatures9 process10 dnsIp11 62 183.201.196.131 SHANXIMCC-IDCIDCShanXiChinaMobilecommunicationscorpora China 22->62 64 101.198.1.198 QIHOOBeijingQihuTechnologyCompanyLimitedCN China 22->64 70 15 other IPs or domains 22->70 38 C:\Users\user\AppData\...\nts94A7.tmp.P2P, PE32 22->38 dropped 40 C:\Users\user\AppData\...\nts9477.tmp.P2P, PE32 22->40 dropped 42 C:\Users\user\AppData\...\nts9476.tmp.P2P, PE32 22->42 dropped 44 5 other malicious files 22->44 dropped 66 20.189.173.21 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 26->66 68 192.168.2.1 unknown unknown 26->68 file12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f080bf1c00fb050cc2a92fb17c08cd22d427782c6f47c532a2462ce3325905f0/
Threat name:
Win32.Backdoor.DarkComet
Create hunting rule
Status:
Malicious
First seen:
2020-09-20 22:41:37 UTC
File Type:
PE (Exe)
Extracted files:
343
AV detection:
35 of 41 (85.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6cal6haa7mcqzqvjf6yxycgnelkco6bmn5d4kmvciywogmszaxya._file
Verdict:
malicious
Similar samples:
4120f6c802618447ffaf9e7ecbf4a234bb031602e601418be74eacadd90accd0
6b99b3a146c21a844705bd2c824a03a63d77163b50c22fcfabc6df9a7a0fe2ca
6da766510fe8768a10d22c5c2bb7e6362d65f6684de20e88f63d66e3be898ab2
98f57a58e8c04c7905cd96329487ea551f61ec1265d991f502fe7413254def12
a49f6e00c0468e074fa2204a7862c22aa3b934af4f2bb281c55d8bb65da67e44
de8c1aa37dd523e0699a10be71185f7a8ac1cde972d04107068f49250ef7317e
f08f4ef5a25eb5b4cda69a00e368c26177fef73e69f3ae34e291b61784a16f82
f954f5ad26b3efdfe4607fa4b0ff25fb82f7284490b283e2fda53b911e88094e
fe2a7fbf5eceff4507690ba13c38817f4ecfa6cbc376ad8829ee121797a866ac
+ 120 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/221231-xsmdwsde7y/
Behaviour
Enumerates physical storage devices
Adds Run key to start application
Unpacked files
SH256 hash:
09472129a8f0d023609d25dc19ebfef4ffccea7cec8318b3c18fa501de452729
MD5 hash:
f60e0ec6422488b7fd2d898bea1b745b
SHA1 hash:
f93eb459fb5e0a3f532c9ad82c0025b41a962ede
Link:
https://www.unpac.me/results/0835692e-a8b1-4a4a-8707-b24b3e1badbd/
SH256 hash:
c8f271f7759b2942b46c59b59f2ad1ee55729bf090f852b1d6102af70716ec02
MD5 hash:
6bed785e159f499510ac7030981f3ddc
SHA1 hash:
c4f8fd3086e12c1eb54e0a8b8a72dc3cf1e124a4
Link:
https://www.unpac.me/results/0835692e-a8b1-4a4a-8707-b24b3e1badbd/
SH256 hash:
90c399abfcca24d181d679e0e2f8ae4a6193ced43211880f2a554bdc56f03a96
MD5 hash:
cc8be755aaf6d3a5f28bc82d111cdeb9
SHA1 hash:
b54795bf5e6c467c92d14abfe821c42bf6f06958
Link:
https://www.unpac.me/results/0835692e-a8b1-4a4a-8707-b24b3e1badbd/
SH256 hash:
ded4ad13ea2ea0b40ea613652573870bdd21a9eed5be8c3e27a60c1d20ebb00d
MD5 hash:
9669d95d6dbd5d36ad7cc790fcffb562
SHA1 hash:
43a50363561a86d162b556f63e18ba75803ecc3e
Link:
https://www.unpac.me/results/0835692e-a8b1-4a4a-8707-b24b3e1badbd/
SH256 hash:
d08f126754c08876c53ac4949ec5bc2d25e0900e4355c3f6a8dfe97d575953eb
MD5 hash:
4a349c00cfc1e728a188485423db25f7
SHA1 hash:
2f706f151c15bd8028fcc260ba582f1a2df58940
Link:
https://www.unpac.me/results/0835692e-a8b1-4a4a-8707-b24b3e1badbd/
SH256 hash:
f080bf1c00fb050cc2a92fb17c08cd22d427782c6f47c532a2462ce3325905f0
MD5 hash:
f4e6aac90793c1830e47adfd445254ae
SHA1 hash:
3de193ff5b14466e9133924a0cbbd47e93e8e4b5
Link:
https://www.unpac.me/results/0835692e-a8b1-4a4a-8707-b24b3e1badbd/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f080bf1c00fb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f080bf1c00fb050cc2a92fb17c08cd22d427782c6f47c532a2462ce3325905f0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments