MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8fc2445a9814ca8cf48a979bff7f182d6538f4d1ff438cf259268e8b4b76f86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Hive


Vendor detections: 11


Intelligence 11 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8fc2445a9814ca8cf48a979bff7f182d6538f4d1ff438cf259268e8b4b76f86
SHA3-384 hash: 17c656b4b21fa4a7cc06db8ba31f81574fccff8defcb852888ae74fcfed2f447873eee29564d32a7a4a8e63c151242ec
SHA1 hash: d1ddbe96ef37c38b4d92bcba3d02bbb2e921ffdc
MD5 hash: a2b371eea0aee7cf57e23b5f0f4668c7
humanhash: oven-juliet-hawaii-texas
File name:f8fc2445a9814ca8cf48a979bff7f182d6538f4d1ff438cf259268e8b4b76f86
Download: download sample
Signature Hive
Create hunting rule
File size:6'599'680 bytes
First seen:2023-02-09 22:07:43 UTC
Last seen:2023-02-09 23:30:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c7269d59926fa4252270f407e4dab043 (46 x Hive, 23 x ServHelper, 22 x CobaltStrike)
ssdeep 98304:5ndLctqeMK9BxMxMkoN7jzEpdF0ohC0RrPU9U:31SBeSrNYpdFh9RrP
Threatray 4'170 similar samples on MalwareBazaar
TLSH T10A669D03F89A54E5C5EAD230CA75C252B731B888473027D32B51EBBA2B77BD46E79350
gimphash 466fa9c52c7da47460084311807cfc516e1da8fe196f19849cacb0b87afc83da
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter cs0sf
Tags:DPRK exe H0lyGhost HealthCare Hive NorthKorea Ransomware

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'101
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f8fc2445a9814ca8cf48a979bff7f182d6538f4d1ff438cf259268e8b4b76f86
Verdict:
No threats detected
Analysis date:
2023-02-09 22:10:12 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/dd13113e-6515-4c81-8a5f-f04031763181

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/363041/
Detection(s):
ditekSHen.MALWARE.Win.Ransomware.Polar.UNOFFICIAL
Create hunting rule

ditekSHen.MALWARE.Win.Ransomware.QnapCrypt-LockedV1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the Windows subdirectories
Running batch commands
Launching the process to interact with network services
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/67358/overview
Behaviour
MalwareBazaar
CPUID_Instruction
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypter filecoder golang greyware packed
Link:
https://www.filescan.io/uploads/63e56ec5459bcf4604002aa6/reports/8432a90d-580f-4abc-be40-f6cc7e7747ad/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f8fc2445a9814ca8cf48a979bff7f182d6538f4d1ff438cf259268e8b4b76f86
Malware family:
HolyGhost Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bd8622c4-ad07-4baf-b271-2502d4c185b4
Result
Threat name:
HolyGhost SiennaBlue
Create hunting rule
Detection:
malicious
Classification:
rans.spyw
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1170578
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Gathers information about network shares
Multi AV Scanner detection for submitted file
Yara detected HolyGhost SiennaBlue Ransomware
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f8fc2445a9814ca8cf48a979bff7f182d6538f4d1ff438cf259268e8b4b76f86/
Threat name:
Win64.Ransomware.SiennaBlue
Create hunting rule
Status:
Malicious
First seen:
2022-07-14 18:17:42 UTC
File Type:
PE+ (Exe)
AV detection:
29 of 39 (74.36%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7d6cirnjqfgkrt2ivf43757rqllfhd2nd72drtzfsjuornfxn6da._file
Verdict:
malicious
Similar samples:
0d0a675516f1ff9247f74df31e90f06b0fea160953e5e3bada5d1c8304cfbe63
Hive
117fc30c25b1f28cd923b530ab9f91a0a818925b0b89b8bc9a7f820a9e630464
Hive
26dfe3d8c976a95bc488e5eaa498169d9f7ef64aca3f7d02a75e13eefb60a91b
Hive
460b096aaf535b0b8f0224da0f04c7f7997c62bf715839a8012c1e1154a38984
Hive
5e6c5a9fda2d20125f6f24e37e8a217a39ff0a5cfddc07ddfdb18049d9ea4597
Hive
76960749ed11d97582923e31d59115910ae74d8753c8e92f918f604ca8a0d26d
Hive
8abaa521a014cdbda2afe77042f21947b147197d274bf801de2df55b1e01c904
Hive
b3d5e4d38a475f509d0ad29beb88753d09509ac3100bdddcf0a42773b2d14a90
Hive
cbdfac8826b8d6eb2c5f01fd617d72a62c63fd4458f10cdd8ce5b16db530dfe7
Hive
f273edc1367f3b4031946254ff4f2d32c2c82f6a7aabbeab86153d5728e0766e
Hive
+ 4'160 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230209-11774sga86/
Behaviour
Runs net.exe
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
f8fc2445a9814ca8cf48a979bff7f182d6538f4d1ff438cf259268e8b4b76f86
MD5 hash:
a2b371eea0aee7cf57e23b5f0f4668c7
SHA1 hash:
d1ddbe96ef37c38b4d92bcba3d02bbb2e921ffdc
Link:
https://www.unpac.me/results/b2a7538a-8179-444c-b80f-1033d491d9c8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/f8fc2445a9814ca8cf48a979bff7f182d6538f4d1ff438cf259268e8b4b76f86

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:QbotStuff
Create hunting rule
Author:anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/363041/

Comments