MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb1d643119c585f25746425ae0c33537611cdfa3a20a1b832034f2346fe55eb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb1d643119c585f25746425ae0c33537611cdfa3a20a1b832034f2346fe55eb6
SHA3-384 hash: cbb9b1441f486b3b7773cb9e0d517a2a6c24254bc8931552ae174fd793e5366ad8356999d3687feac07c7a825a82ab85
SHA1 hash: 502467f4aaf46751c8ba8c94de96efb2c4c55da6
MD5 hash: 36889b06de5a292bc2165519301e5d3c
humanhash: blue-cola-delaware-pizza
File name:9d2e1162e20c67bb61024344acb38b2e
Download: download sample
File size:262'656 bytes
First seen:2020-11-17 12:13:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2fc42234519541036aac21177faf33
ssdeep 6144:2X6Hk+WmnFWiHI9MtB34409/JnuIsFLXPIgjVtWEyb1MMMMMMSO:nEewiHI9WF09xu3LfIgxt+MMMMMMB
Threatray 3 similar samples on MalwareBazaar
TLSH 2B44AEAA3231A081D53D8178F321CACA7A54FFD2EFD8E5A74C49399CE1751EA6527C30
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.PrivateExeProte-16
Create hunting rule

PUA.Win.Packer.Ep-7
Create hunting rule

PUA.Win.Packer.Embedpe-3
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Creating a window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb1d643119c585f25746425ae0c33537611cdfa3a20a1b832034f2346fe55eb6/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:17:47 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
077c87d4fef3f9c93485d04bebcfc01bd976f76c93b165a8b02a35545aa41436
a9ecdf87c4aaaf8b3ff46a06471db127ccbc48eb0d340eb299416a66b7733e89
d9f990b7f6c926b198f2ca401cef7857e67bae26f9d437adcf265101d059899c
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/201117-zr36k1rwns/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
fb1d643119c585f25746425ae0c33537611cdfa3a20a1b832034f2346fe55eb6
MD5 hash:
36889b06de5a292bc2165519301e5d3c
SHA1 hash:
502467f4aaf46751c8ba8c94de96efb2c4c55da6
Link:
https://www.unpac.me/results/a701c27e-0b93-49e8-9227-d22bda3870f7/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments