MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f56aae59105111fcd9421dcfcbea05f0415cc85b68223331cc4e9cfd2b0035dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f56aae59105111fcd9421dcfcbea05f0415cc85b68223331cc4e9cfd2b0035dc
SHA3-384 hash: 37c2b4a4a6eb539b92fd27b52c9aa41e858a66978ff83e85adacee57771c4d968e308213b783d1213a40dd69a43f4075
SHA1 hash: 326f43e9bfdcfa8b3bd407f51922f215a215279d
MD5 hash: 5875725554397137b21e171f7b9d5cc0
humanhash: shade-nitrogen-single-carolina
File name:5875725554397137b21e171f7b9d5cc0
Download: download sample
File size:3'247'616 bytes
First seen:2021-10-20 22:23:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 57c9b357ae0cb2f414b0a5873e2f216d
ssdeep 49152:GB0pfVXlqrb/TFvO90dL3BmAFd4A64nsfJ96ZcHSyAbhanA+frsdD1qtXEJ+GRgM:GB0z7Vdn5D1Fd
Threatray 3 similar samples on MalwareBazaar
TLSH T11DE55C03F89258F9C4BBC230CA6693A27A31B495133057D76B909BB92F6AFD01E7D354
Reporter zbetcheckin
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/198925/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.47191723.10030.23615.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug monero
Link:
https://www.filescan.io/uploads/61709706a9d585e6d5304110/reports/8d348a6c-7bdd-421e-88bc-dbeba89761e8/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c43e1da6-8a10-488b-ab3b-acc141d96057
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/874228
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 506656 Sample: 8iY7ti8xa2 Startdate: 21/10/2021 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 6 8iY7ti8xa2.exe 1 2->6         started        process3 process4 8 conhost.exe 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f56aae59105111fcd9421dcfcbea05f0415cc85b68223331cc4e9cfd2b0035dc/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-10-14 08:10:13 UTC
AV detection:
5 of 28 (17.86%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
5cbea0c2d3f18aafe1c3ab60b3d670bcc47e4001f26c8923c3e4735e6964708c
6cc8e13f66166e615a847f9444a0258b0e7a01fb8e607c49c482b2b4d50cd829
a6716509395bbeb0b27d4f384927e7c5b3e75f9fa6e1def742340ab128c15a89
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211020-2bc64shfd7/
Unpacked files
SH256 hash:
f56aae59105111fcd9421dcfcbea05f0415cc85b68223331cc4e9cfd2b0035dc
MD5 hash:
5875725554397137b21e171f7b9d5cc0
SHA1 hash:
326f43e9bfdcfa8b3bd407f51922f215a215279d
Link:
https://www.unpac.me/results/e4b5a622-9b21-49a8-b410-1b01bdcb7ca5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f56aae59105111fcd9421dcfcbea05f0415cc85b68223331cc4e9cfd2b0035dc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:GoBinTest
Create hunting rule
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:golang
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe f56aae59105111fcd9421dcfcbea05f0415cc85b68223331cc4e9cfd2b0035dc

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1703461/
Cape
Cape
https://www.capesandbox.com/analysis/198925/

Comments


Avatar
zbet commented on 2021-10-20 22:23:40 UTC

url : hxxp://213.226.71.125/clean.exe