MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f82e3cf3a8fedbb9e49f82a5c56464377d6e384662c6586db1c14cb9670fcc88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f82e3cf3a8fedbb9e49f82a5c56464377d6e384662c6586db1c14cb9670fcc88
SHA3-384 hash: 33bcff1df1233cccc07c28cca8d7bda98a2564b5d2af0c03211fe3650b23d7ffdae2f6bbfcb3c898a2feb0d008008202
SHA1 hash: 2b656b2d228394644f1879dfb1f1e4f77032d466
MD5 hash: 4791c16ae0adab9923e4460997fb1643
humanhash: crazy-pennsylvania-yankee-oven
File name:f82e3cf3a8fedbb9e49f82a5c56464377d6e384662c6586db1c14cb9670fcc88
Download: download sample
File size:622'592 bytes
First seen:2020-06-29 07:21:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4511896d043677e4ab4578dc5bcab5a0 (35 x SakulaRAT)
ssdeep 12288:0RfQn+w8EYiBlMkn5f9J105ko8T6csV5Y:g4+wlYBsb3zNs5Y
Threatray 143 similar samples on MalwareBazaar
TLSH 99D428A4BE9DC4E3F71774B1AC73738233B77C245A19B51A9388EA3CC4E3D50A51981A
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Sakula
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15551/
Detection(s):
Win.Downloader.Upatre-5744092-0
Create hunting rule

Win.Downloader.Upatre-5744094-0
Create hunting rule

Win.Trojan.Generic-6296810-0
Create hunting rule

Win.Keylogger.Tinba-6622757-0
Create hunting rule

Win.Trojan.VBGeneric-6735876-0
Create hunting rule

Win.Malware.Scar-6745903-0
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f82e3cf3a8fedbb9e49f82a5c56464377d6e384662c6586db1c14cb9670fcc88/
Threat name:
Win32.Trojan.Sakurel
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 02:15:30 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
29 of 29 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
sakularat
Create hunting rule
Similar samples:
00207fd3bf8a379ab27531ab47b13c775d2519f10df9c331d4d64e90bd5206b9
1e4c52155582f5eeb5c7a946c20c2030b3c90303f1b23eb2261a8b9a91a8594f
1f89b0759c021884b598c36f30779d2aba64800f3dec7fdd45e6263ec8d7be23
2482e74612ee6630371130c86429a979a25f58b08c18a4b9695cd86dc87e80da
52c0523a4ebf65f913e30e1c50b3bb7fc231d21774b6a1104caf106e1b0d6b5a
53497eda5fa82e772599ff5a303e488e19f85b12199c316514e6af6a79d88a46
88310a7eb0991c1088029656f81518ef578a45c786ca5b545bb355af0f36993d
a735f487179cdb2e5fb6a366750e12c774d485a6259cbdc8c0aa6f726b1992f7
ed4aef67444c1b22bd8ef038a1544fbcc65b602111020db1a5a2a88e1964e4f1
fd7ee166a2ef80d3dc9668383540eade22f9cf7125a870bd0efb0f14b1239e31
+ 133 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/200629-sjb2jn96px/
Behaviour
Runs ping.exe
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Adds Run entry to start application
Loads dropped DLL
Deletes itself
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15551/

Comments