MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9ed3c070a2731acbfef6d4b2af980b6e922b2dda0e9227e02f4b4f3821f4b17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 6 File information Yara Comments

SHA256 hash: f9ed3c070a2731acbfef6d4b2af980b6e922b2dda0e9227e02f4b4f3821f4b17
SHA3-384 hash: 9f608424b74fee9110da12428309b21b3429d2203ae3a7bc143e75320a8ae7b09a3772acf517b304f50ce072938ab7b8
SHA1 hash: ad530c2f6291a7ca1001b8698cf6587c70aba47c
MD5 hash: 9a59c5c95c68d06ccf2a38cd40d67a40
humanhash: november-moon-pluto-kentucky
File name:Filecoder Nemty 64bit
Download: download sample
Signature Nefilim
File size:3'133'728 bytes
First seen:2020-08-01 19:44:44 UTC
Last seen:2020-08-01 20:31:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 96c44fa1eee2c4e9b9e77d7bf42d59e6
ssdeep 24576:6OXKA8qDbjm8N3CNW0qdQCVzCYXjG9xLAW0bUXo2xdQS3aVOqL1UrSlcbHLWcR4+:HXKOm8mwdHJC0jG9xE9gdQS3aLibLw
TLSH 2FE53A07FDD654E3D7F9F23149B25B627776B068032277D31E948B7D190AAA42E2E308
Reporter @JAMESWT_MHT
Tags:Nefilim

Intelligence


File Origin
# of uploads :
2
# of downloads :
89
Origin country :
IT IT
Mail intelligence
No data
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file
Changing a file
Reading critical registry keys
Creating a file in the mass storage device
Stealing user critical data
Encrypting user's files
Result
Threat name:
Nefilim
Detection:
malicious
Classification:
rans.evad
Score:
60 / 100
Signature
Found Tor onion address
May encrypt documents and pictures (Ransomware)
Modifies existing user documents (likely ransomware behavior)
Yara detected Nefilim ransomware
Behaviour
Behavior Graph:
Threat name:
Win64.Ransomware.Nemty
Status:
Malicious
First seen:
2020-07-16 00:43:47 UTC
AV detection:
23 of 31 (74.19%)
Threat level
  5/5
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Behaviour
JavaScript code in executable

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments